hitoshura25/cvefixes huggingface dataset:
CVE-2019-13298 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/pixel-accessor.h in SetPixelViaPixelInfo because of a MagickCore/enhance.c error.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/enhance.c
MagickCore/pixel-accessor.h
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1611


Vulnerable code:
      SetPixelViaPixelInfo(image,&pixel,q);
  if (image->channel_map[image->channel_map[channel].offset].traits == UndefinedPixelTrait)

Fixed code:
      SetPixelViaPixelInfo(enhance_image,&pixel,q);
  if (image->channel_map[channel].traits == UndefinedPixelTrait)
CVE-2019-13299 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/pixel-accessor.h in GetPixelChannel.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/pixel-accessor.h
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1610


Vulnerable code:
  if (image->channel_map[channel].traits == UndefinedPixelTrait)

Fixed code:
  if (image->channel_map[image->channel_map[channel].offset].traits == UndefinedPixelTrait)
CVE-2019-13300 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/statistic.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1586


Vulnerable code:
static PixelChannels **AcquirePixelThreadSet(const Image *image)
    pixels[i]=(PixelChannels *) AcquireQuantumMemory(image->columns,
      sizeof(**pixels));
    for (j=0; j < (ssize_t) image->columns; j++)

Fixed code:
static PixelChannels **AcquirePixelThreadSet(const Image *images)
  const Image
    *next;

    columns,
  columns=images->columns;
  for (next=images; next != (Image *) NULL; next=next->next)
    columns=MagickMax(next->columns,columns);
    pixels[i]=(PixelChannels *) AcquireQuantumMemory(columns,sizeof(**pixels));
    for (j=0; j < (ssize_t) columns; j++)
CVE-2019-13301 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has memory leaks in AcquireMagickMemory because of an AnnotateImage error.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/annotate.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1589


Vulnerable code:
    return(MagickFalse);
    return(MagickFalse);

Fixed code:
    {
      annotate_info=DestroyDrawInfo(annotate_info);
      annotate=DestroyDrawInfo(annotate);
      return(MagickFalse);
    }
    {
      annotate_info=DestroyDrawInfo(annotate_info);
      annotate=DestroyDrawInfo(annotate);
      textlist=(char **) RelinquishMagickMemory(textlist);
      return(MagickFalse);
    }
CVE-2019-13302 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/fourier.c in ComplexImages.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/fourier.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1597


Vulnerable code:
      for (i=0; i < (ssize_t) GetPixelChannels(Cr_image); i++)

Fixed code:
  size_t
    number_channels;

  number_channels=MagickMin(MagickMin(MagickMin(
    Ar_image->number_channels,Ai_image->number_channels),MagickMin(
    Br_image->number_channels,Bi_image->number_channels)),MagickMin(
    Cr_image->number_channels,Ci_image->number_channels));
      for (i=0; i < (ssize_t) number_channels; i++)
CVE-2019-13303 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/composite.c in CompositeImage.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/composite.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1603


Vulnerable code:
          for (i=0; i < (ssize_t) GetPixelChannels(image); i++)
            PixelChannel channel = GetPixelChannelChannel(image,i);
            PixelTrait traits = GetPixelChannelTraits(image,channel);
            PixelTrait source_traits=GetPixelChannelTraits(source_image,
            if (traits == UndefinedPixelTrait)
            if (source_traits != UndefinedPixelTrait)
            else if (channel == AlphaPixelChannel)
              SetPixelChannel(image,channel,OpaqueAlpha,q);

Fixed code:
          for (i=0; i < (ssize_t) GetPixelChannels(source_image); i++)
            PixelChannel channel = GetPixelChannelChannel(source_image,i);
            PixelTrait source_traits = GetPixelChannelTraits(source_image,
            PixelTrait traits = GetPixelChannelTraits(image,channel);
            if (source_traits == UndefinedPixelTrait)
            if (traits != UndefinedPixelTrait)
            else
              if (channel == AlphaPixelChannel)
                SetPixelChannel(image,channel,OpaqueAlpha,q);
CVE-2019-13304 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/pnm.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1614


Vulnerable code:
            *q++=' ';

Fixed code:
            *q++=' ';
CVE-2019-13305 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/pnm.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1613


Vulnerable code:
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            if ((q-pixels+extent+2) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;

Fixed code:
            if ((q-pixels+extent+1) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
CVE-2019-13305 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/pnm.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1613


Vulnerable code:
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            if ((q-pixels+extent+2) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;

Fixed code:
            if ((q-pixels+extent+1) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
CVE-2019-13306 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/pnm.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1612


Vulnerable code:
            if ((q-pixels+extent+1) >= sizeof(pixels))
            if ((q-pixels+extent+1) >= sizeof(pixels))

Fixed code:
            if ((q-pixels+extent+2) >= sizeof(pixels))
            if ((q-pixels+extent+2) >= sizeof(pixels))
CVE-2019-13306 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/pnm.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1612


Vulnerable code:
            if ((q-pixels+extent+1) >= sizeof(pixels))
            if ((q-pixels+extent+1) >= sizeof(pixels))

Fixed code:
            if ((q-pixels+extent+2) >= sizeof(pixels))
            if ((q-pixels+extent+2) >= sizeof(pixels))
CVE-2019-13307 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/statistic.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1615


Vulnerable code:
    number_threads;
  number_threads=(size_t) GetMagickResourceLimit(ThreadResource);
  pixels=(PixelChannels **) AcquireQuantumMemory(number_threads,
    sizeof(*pixels));
  (void) memset(pixels,0,number_threads*sizeof(*pixels));
  columns=images->columns;
  for (i=0; i < (ssize_t) number_threads; i++)

Fixed code:
    rows;
  rows=MagickMax(GetImageListLength(images),
    (size_t) GetMagickResourceLimit(ThreadResource));
  pixels=(PixelChannels **) AcquireQuantumMemory(rows,sizeof(*pixels));
  columns=MaxPixelChannels;
  for (i=0; i < (ssize_t) rows; i++)
CVE-2019-13308 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow in MagickCore/fourier.c in ComplexImage.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/fourier.c
coders/gif.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1595


Vulnerable code:
    magick_number_threads(images,complex_images,images->rows,1L)
  for (y=0; y < (ssize_t) images->rows; y++)
    Ar=GetCacheViewVirtualPixels(Ar_view,0,y,
      MagickMax(Ar_image->columns,Cr_image->columns),1,exception);
    Ai=GetCacheViewVirtualPixels(Ai_view,0,y,
      MagickMax(Ai_image->columns,Ci_image->columns),1,exception);
    Br=GetCacheViewVirtualPixels(Br_view,0,y,
      MagickMax(Br_image->columns,Cr_image->columns),1,exception);
    Bi=GetCacheViewVirtualPixels(Bi_view,0,y,
      MagickMax(Bi_image->columns,Ci_image->columns),1,exception);
    for (x=0; x < (ssize_t) images->columns; x++)
      for (i=0; i < (ssize_t) GetPixelChannels(images); i++)
            gamma=PerceptibleReciprocal(Br[i]*Br[i]+Bi[i]*Bi[i]+snr);
            Cr[i]=gamma*(Ar[i]*Br[i]+Ai[i]*Bi[i]);
            Ci[i]=gamma*(Ai[i]*Br[i]-Ar[i]*Bi[i]);
            Cr[i]=sqrt(Ar[i]*Ar[i]+Ai[i]*Ai[i]);
            Ci[i]=atan2(Ai[i],Ar[i])/(2.0*MagickPI)+0.5;
            Cr[i]=QuantumScale*(Ar[i]*Br[i]-Ai[i]*Bi[i]);
            Ci[i]=QuantumScale*(Ai[i]*Br[i]+Ar[i]*Bi[i]);
      next_pixel=MagickFalse;
      displacement=1;

Fixed code:
    magick_number_threads(Cr_image,complex_images,Cr_image->rows,1L)
  for (y=0; y < (ssize_t) Cr_image->rows; y++)
    Ar=GetCacheViewVirtualPixels(Ar_view,0,y,Cr_image->columns,1,exception);
    Ai=GetCacheViewVirtualPixels(Ai_view,0,y,Cr_image->columns,1,exception);
    Br=GetCacheViewVirtualPixels(Br_view,0,y,Cr_image->columns,1,exception);
    Bi=GetCacheViewVirtualPixels(Bi_view,0,y,Cr_image->columns,1,exception);
    for (x=0; x < (ssize_t) Cr_image->columns; x++)
      for (i=0; i < (ssize_t) GetPixelChannels(Cr_image); i++)
            gamma=PerceptibleReciprocal((double) Br[i]*Br[i]+Bi[i]*Bi[i]+snr);
            Cr[i]=gamma*((double) Ar[i]*Br[i]+(double) Ai[i]*Bi[i]);
            Ci[i]=gamma*((double) Ai[i]*Br[i]-(double) Ar[i]*Bi[i]);
            Cr[i]=sqrt((double) Ar[i]*Ar[i]+(double) Ai[i]*Ai[i]);
            Ci[i]=atan2((double) Ai[i],(double) Ar[i])/(2.0*MagickPI)+0.5;
            Cr[i]=QuantumScale*((double) Ar[i]*Br[i]-(double) Ai[i]*Bi[i]);
            Ci[i]=QuantumScale*((double) Ai[i]*Br[i]+(double) Ar[i]*Bi[i]);
      next_pixel=MagickFalse;
      displacement=1;
      if (k < 0)
        continue;
CVE-2019-13309 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage error in CLIListOperatorImages in MagickWand/operation.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickWand/mogrify.c
MagickWand/operation.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1616


Vulnerable code:
                 CLIWandExceptArgBreak(OptionError,"NoSuchImage",option,arg1);

Fixed code:
            reconstruct_image=DestroyImage(reconstruct_image);
            image=DestroyImage(image);
                       p=DestroyImage(p);
                 {
                   insert_image=DestroyImage(insert_image);
                   CLIWandExceptArgBreak(OptionError,"NoSuchImage",option,arg1);
                 }
CVE-2019-13310 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in MagickWand/mogrify.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickWand/mogrify.c
MagickWand/operation.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1616


Vulnerable code:
                 CLIWandExceptArgBreak(OptionError,"NoSuchImage",option,arg1);

Fixed code:
            reconstruct_image=DestroyImage(reconstruct_image);
            image=DestroyImage(image);
                       p=DestroyImage(p);
                 {
                   insert_image=DestroyImage(insert_image);
                   CLIWandExceptArgBreak(OptionError,"NoSuchImage",option,arg1);
                 }
CVE-2019-13391 (C, published 2019-07-07T22:15Z)
Description: value: In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/annotate.c
MagickCore/fourier.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1588


Vulnerable code:
    Ar=GetCacheViewVirtualPixels(Ar_view,0,y,Ar_image->columns,1,exception);
    Ai=GetCacheViewVirtualPixels(Ai_view,0,y,Ai_image->columns,1,exception);
    Br=GetCacheViewVirtualPixels(Br_view,0,y,Br_image->columns,1,exception);
    Bi=GetCacheViewVirtualPixels(Bi_view,0,y,Bi_image->columns,1,exception);

Fixed code:
      text=DestroyString(text);
      text=DestroyString(text);
  text=DestroyString(text);
    Ar=GetCacheViewVirtualPixels(Ar_view,0,y,
      MagickMax(Ar_image->columns,Cr_image->columns),1,exception);
    Ai=GetCacheViewVirtualPixels(Ai_view,0,y,
      MagickMax(Ai_image->columns,Ci_image->columns),1,exception);
    Br=GetCacheViewVirtualPixels(Br_view,0,y,
      MagickMax(Br_image->columns,Cr_image->columns),1,exception);
    Bi=GetCacheViewVirtualPixels(Bi_view,0,y,
      MagickMax(Bi_image->columns,Ci_image->columns),1,exception);
CVE-2019-13454 (C, published 2019-07-09T17:15Z)
Description: value: ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/layer.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1629


Vulnerable code:
MagickExport void RemoveDuplicateLayers(Image **images,
     ExceptionInfo *exception)
  register Image
    *curr,
    *next;

    (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",(*images)->filename);

  curr=GetFirstImageInList(*images);
  for (; (next=GetNextImageInList(curr)) != (Image *) NULL; curr=next)
    if ( curr->columns != next->columns || curr->rows != next->rows
         || curr->page.x != next->page.x || curr->page.y != next->page.y )
    bounds=CompareImagesBounds(curr,next,CompareAnyLayer,exception);
    if ( bounds.x < 0 ) {
      /*
        the two images are the same, merge time delays and delete one.
      */
      size_t time;
      time = curr->delay*1000/curr->ticks_per_second;
      time += next->delay*1000/next->ticks_per_second;
      next->ticks_per_second = 100L;
      next->delay = time*curr->ticks_per_second/1000;
      next->iterations = curr->iterations;
      *images = curr;
      (void) DeleteImageFromList(images);
    }
  *images = GetFirstImageInList(*images);

Fixed code:
MagickExport void RemoveDuplicateLayers(Image **images,ExceptionInfo *exception)
  register Image
    *image,
    *next;

    (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",
      (*images)->filename);
  image=GetFirstImageInList(*images);
  for ( ; (next=GetNextImageInList(image)) != (Image *) NULL; image=next)
    if ((image->columns != next->columns) || (image->rows != next->rows) ||
        (image->page.x != next->page.x) || (image->page.y != next->page.y))
    bounds=CompareImagesBounds(image,next,CompareAnyLayer,exception);
    if (bounds.x < 0)
      {
        /*
          Two images are the same, merge time delays and delete one.
        */
        size_t
          time;

        time=1000*image->delay*PerceptibleReciprocal(image->ticks_per_second);
        time+=1000*next->delay*PerceptibleReciprocal(next->ticks_per_second);
        next->ticks_per_second=100L;
        next->delay=time*image->ticks_per_second/1000;
        next->iterations=image->iterations;
        *images=image;
        (void) DeleteImageFromList(images);
      }
  *images=GetFirstImageInList(*images);
CVE-2019-14980 (C, published 2019-08-12T23:15Z)
Description: value: In ImageMagick 7.x before 7.0.8-42 and 6.x before 6.9.10-42, there is a use after free vulnerability in the UnmapBlob function that allows an attacker to cause a denial of service by sending a crafted file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/blob.c
Commit message: https://github.com/ImageMagick/ImageMagick6/issues/43


Vulnerable code:

Fixed code:
      blob_info->data=NULL;
CVE-2019-14981 (C, published 2019-08-12T23:15Z)
Description: value: In ImageMagick 7.x before 7.0.8-41 and 6.x before 6.9.10-41, there is a divide-by-zero vulnerability in the MeanShiftImage function. It allows an attacker to cause a denial of service by sending a crafted file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/feature.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1552


Vulnerable code:
        gamma=1.0/count;

Fixed code:
        gamma=PerceptibleReciprocal(count);
CVE-2019-15139 (C, published 2019-08-18T19:15Z)
Description: value: The XWD image (X Window System window dumping file) parsing component in ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (application crash resulting from an out-of-bounds Read) in ReadXWDImage in coders/xwd.c by crafting a corrupted XWD image file, a different vulnerability than CVE-2019-11472.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/xwd.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1553


Vulnerable code:
          (header.ncolors == 0))
  if (header.ncolors > 65535)
    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
      colors=(XColor *) AcquireQuantumMemory((size_t) header.ncolors,
        sizeof(*colors));

Fixed code:
  if ((MagickSizeType) header.xoffset >= GetBlobSize(image))
    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
          (header.colormap_entries == 0))
      length=(size_t) header.ncolors;
      if (length > ((~0UL)/sizeof(*colors)))
        ThrowReaderException(CorruptImageError,"ImproperImageHeader");
      colors=(XColor *) AcquireQuantumMemory(length,sizeof(*colors));
  entry->flags|=CoderDecoderSeekableStreamFlag;