hitoshura25/cvefixes huggingface dataset:
CVE-2016-10052 (C, published 2017-03-23T17:59Z)
Description: value: Buffer overflow in the WriteProfile function in coders/jpeg.c in ImageMagick before 6.9.5-6 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/jpeg.c
config/english.xml
Commit message: Changed the JPEG writer to raise a warning when the exif profile exceeds 65533 bytes and truncate it.


Vulnerable code:
static void WriteProfile(j_compress_ptr jpeg_info,Image *image)
      for (i=0; i < (ssize_t) GetStringInfoLength(profile); i+=65533L)
        length=MagickMin(GetStringInfoLength(profile)-i,65533L);
        jpeg_write_marker(jpeg_info,XML_MARKER,GetStringInfoDatum(profile)+i,
    WriteProfile(&jpeg_info,image);

Fixed code:
static void WriteProfile(j_compress_ptr jpeg_info,Image *image,
  ExceptionInfo *exception)
        length=GetStringInfoLength(profile);
        if (length > 65533L)
          {
            (void) ThrowMagickException(exception,GetMagickModule(),
              CoderWarning,"ExifProfileSizeExceedsLimit",image->filename);
            length=65533L;
          }
        jpeg_write_marker(jpeg_info,XML_MARKER,GetStringInfoDatum(profile),
    WriteProfile(&jpeg_info,image,exception);
        <message name="ExifProfileSizeExceedsLimit">
          exif profile size exceeds limit and will be truncated
        </message>
CVE-2016-10053 (Other, published 2017-03-23T17:59Z)
Description: value: The WriteTIFFImage function in coders/tiff.c in ImageMagick before 6.9.5-8 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
ChangeLog
coders/tiff.c
Commit message: Fix TIFF divide by zero (bug report from Donghai Zhu)


Vulnerable code:
  * Prevent buffer overflow in SIXEL, PDB, MAP, and CALS coders (bug report
    from Donghai Zhu).
     rows_per_strip=TIFFDefaultStripSize(tiff,0);

Fixed code:
  * Prevent buffer overflow and other problems in SIXEL, PDB, MAP, TIFF and
    CALS coders (bug report from Donghai Zhu).
    rows_per_strip=1;
    if (TIFFScanlineSize(tiff) != 0)
      rows_per_strip=TIFFDefaultStripSize(tiff,0);
CVE-2016-10058 (C, published 2017-03-23T17:59Z)
Description: value: Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick before 6.9.6-3 allows remote attackers to cause a denial of service (memory consumption) via a crafted image file.
Severity: HIGH (CVSS v3 base score: 5.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/psd.c
Commit message: Fixed memory leak.


Vulnerable code:

Fixed code:
            if (layer_info[i].info != (StringInfo *) NULL)
              layer_info[i].info=DestroyStringInfo(layer_info[i].info);
CVE-2016-10060 (C, published 2017-03-02T21:59Z)
Description: value: The ConcatenateImages function in MagickWand/magick-cli.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (application crash) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-252 \u2014 Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickWand/magick-cli.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/196


Vulnerable code:
     ExceptionInfo *exception )
         GetExceptionMessage(errno));

  if (output == (FILE *) NULL) {
    ThrowFileException(exception,FileOpenError,"UnableToOpenFile",argv[argc-1]);
    return(MagickFalse);
  }
  for (i=2; i < (ssize_t) (argc-1); i++) {
#if 0
    fprintf(stderr, "DEBUG: Concatenate Image: \"%s\"\n", argv[i]);
#endif
    if (input == (FILE *) NULL) {
      (void) fputc((char) c,output);
  return(MagickTrue);

Fixed code:
  ExceptionInfo *exception )
  MagickBooleanType
    status;

      GetExceptionMessage(errno));
  if (output == (FILE *) NULL)
    {
      ThrowFileException(exception,FileOpenError,"UnableToOpenFile",
        argv[argc-1]);
      return(MagickFalse);
    }
  status=MagickTrue;
  for (i=2; i < (ssize_t) (argc-1); i++)
  {
    if (input == (FILE *) NULL)
      {
      if (fputc((char) c,output) != c)
        status=MagickFalse;
  return(status);
CVE-2016-10061 (C, published 2017-03-03T17:59Z)
Description: value: The ReadGROUP4Image function in coders/tiff.c in ImageMagick before 7.0.1-10 does not check the return value of the fputc function, which allows remote attackers to cause a denial of service (crash) via a crafted image file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-252 \u2014 Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/tiff.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/196


Vulnerable code:
    (void) fputc(c,file);

Fixed code:
  status=MagickTrue;
    if (fputc(c,file) != c)
      status=MagickFalse;
  if (status == MagickFalse)
    image=DestroyImage(image);
CVE-2016-10063 (C, published 2017-03-02T21:59Z)
Description: value: Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file, related to extend validity.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/tiff.c
Commit message: ...


Vulnerable code:
    status=SetImageExtent(image,image->columns,image->rows,exception);
    if (status == MagickFalse)
      return(DestroyImageList(image));

Fixed code:
    status=SetImageExtent(image,image->columns,image->rows,exception);
    if (status == MagickFalse)
      return(DestroyImageList(image));
CVE-2016-10064 (C, published 2017-03-02T21:59Z)
Description: value: Buffer overflow in coders/tiff.c in ImageMagick before 6.9.5-1 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/tiff.c
Commit message: Improve buffer overflow sanity check


Vulnerable code:
        if ((number_pixels*sizeof(uint32)) != (MagickSizeType) ((size_t)
            (number_pixels*sizeof(uint32))))
        tile_pixels=(uint32 *) AcquireQuantumMemory(columns,
          rows*sizeof(*tile_pixels));
        if ((number_pixels*sizeof(uint32)) != (MagickSizeType) ((size_t)
            (number_pixels*sizeof(uint32))))
        (void) TIFFReadRGBAImage(tiff,(uint32) image->columns,
          (uint32) image->rows,(uint32 *) pixels,0);

Fixed code:
#include "MagickCore/memory-private.h"
        if (HeapOverflowSanityCheck(rows,sizeof(*tile_pixels)) != MagickFalse)
        tile_pixels=(uint32 *) AcquireQuantumMemory(columns,rows*
          sizeof(*tile_pixels));
        if (HeapOverflowSanityCheck(image->rows,sizeof(*pixels)) != MagickFalse)
        (void) TIFFReadRGBAImage(tiff,(uint32) image->columns,(uint32)
          image->rows,(uint32 *) pixels,0);
CVE-2016-10065 (C, published 2017-03-03T17:59Z)
Description: value: The ReadVIFFImage function in coders/viff.c in ImageMagick before 7.0.1-0 allows remote attackers to cause a denial of service (application crash) or have other unspecified impact via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/memory.c
MagickCore/quantum-import.c
coders/viff.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/129


Vulnerable code:
    image->alpha_trait=viff_info.number_data_bands == 4 ? BlendPixelTrait : 
      max_packets=((image->columns+7UL) >> 3UL)*image->rows;
      max_packets=(size_t) (number_pixels*viff_info.number_data_bands);
                  

Fixed code:

  pixel=0;

static MagickBooleanType CheckMemoryOverflow(const size_t count,
  const size_t quantum)
{
  size_t
    size;

  size=count*quantum;
  if ((count == 0) || (quantum != (size/count)))
    {
      errno=ENOMEM;
      return(MagickTrue);
    }
  return(MagickFalse);
}

    image->alpha_trait=viff_info.number_data_bands == 4 ? BlendPixelTrait :
      {
        if (CheckMemoryOverflow((image->columns+7UL) >> 3UL,image->rows) != MagickFalse)
          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
        max_packets=((image->columns+7UL) >> 3UL)*image->rows;
      }
      {
        if (CheckMemoryOverflow(number_pixels,viff_info.number_data_bands) != MagickFalse)
          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
        max_packets=(size_t) (number_pixels*viff_info.number_data_bands);
      }
CVE-2016-10070 (C, published 2017-03-03T18:59Z)
Description: value: Heap-based buffer overflow in the CalcMinMax function in coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/mat.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/131


Vulnerable code:

Fixed code:
    quantum_info=DestroyQuantumInfo(quantum_info);
CVE-2016-10071 (C, published 2017-03-02T21:59Z)
Description: value: coders/mat.c in ImageMagick before 6.9.4-0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted mat file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/mat.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/131


Vulnerable code:
    BImgBuff = (unsigned char *) AcquireQuantumMemory((size_t) (ldblk),sizeof(unsigned char));    /* Ldblk was set in the check phase */

Fixed code:
    BImgBuff = (unsigned char *) AcquireQuantumMemory((size_t) (ldblk),sizeof(double));    /* Ldblk was set in the check phase */
CVE-2016-5688 (C, published 2016-12-13T15:59Z)
Description: value: The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the SetImageExtent return-value check, which trigger (1) a heap-based buffer overflow in the SetPixelIndex function or an invalid write operation in the (2) ScaleCharToQuantum or (3) SetPixelIndex functions.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/wpg.c
Commit message: Ensure image extent does not exceed maximum


Vulnerable code:
  status=SetImageExtent(image,image->columns,image->rows,exception);
  if (status == MagickFalse)
    return(DestroyImageList(image));

Fixed code:
              status=SetImageExtent(image,image->columns,image->rows,exception);
              if (status == MagickFalse)
                break;
              status=SetImageExtent(image,image->columns,image->rows,exception);
              if (status == MagickFalse)
                break;
CVE-2016-5688 (C, published 2016-12-13T15:59Z)
Description: value: The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified impact via vectors related to the SetImageExtent return-value check, which trigger (1) a heap-based buffer overflow in the SetPixelIndex function or an invalid write operation in the (2) ScaleCharToQuantum or (3) SetPixelIndex functions.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/cache.c
MagickCore/image.c
coders/wpg.c
Commit message: Set pixel cache to undefined if any resource limit is exceeded


Vulnerable code:
        ThrowImageException(ResourceLimitError,"MemoryAllocationFailed");


Fixed code:
      cache_info->type=UndefinedCache;
      cache_info->type=UndefinedCache;
      cache_info->type=UndefinedCache;
              if (status == MagickFalse)
                cache_info->type=UndefinedCache;
  if (status == MagickFalse)
    cache_info->type=UndefinedCache;
        {
          clone_image=DestroyImage(clone_image);
          ThrowImageException(ResourceLimitError,"MemoryAllocationFailed");
        }
CVE-2016-5689 (Other, published 2016-12-13T15:59Z)
Description: value: The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact by leveraging lack of NULL pointer checks.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
ChangeLog
coders/dcm.c
Commit message: Add additional checks to DCM reader to prevent data-driven faults (bug report from Hanno Böck


Vulnerable code:
      for (i=0; i < (ssize_t) (GetQuantumRange(depth)+1); i++)
                    pixel.red=scale[pixel.red];
                    pixel.green=scale[pixel.green];
                    pixel.blue=scale[pixel.blue];

Fixed code:
  * Add additional checks to DCM reader to prevent data-driven faults (bug
    report from Hanno Böck).
            if (data == (unsigned char *) NULL)
              break;
            if (data == (unsigned char *) NULL)
              break;
      for (i=0; i <= (ssize_t) GetQuantumRange(depth); i++)
                    if (pixel.red <= GetQuantumRange(depth))
                      pixel.red=scale[pixel.red];
                    if (pixel.green <= GetQuantumRange(depth))
                      pixel.green=scale[pixel.green];
                    if (pixel.blue <= GetQuantumRange(depth))
                      pixel.blue=scale[pixel.blue];
CVE-2016-5690 (Other, published 2016-12-13T15:59Z)
Description: value: The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact via vectors involving the for statement in computing the pixel scaling table.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
ChangeLog
coders/dcm.c
Commit message: Add additional checks to DCM reader to prevent data-driven faults (bug report from Hanno Böck


Vulnerable code:
      for (i=0; i < (ssize_t) (GetQuantumRange(depth)+1); i++)
                    pixel.red=scale[pixel.red];
                    pixel.green=scale[pixel.green];
                    pixel.blue=scale[pixel.blue];

Fixed code:
  * Add additional checks to DCM reader to prevent data-driven faults (bug
    report from Hanno Böck).
            if (data == (unsigned char *) NULL)
              break;
            if (data == (unsigned char *) NULL)
              break;
      for (i=0; i <= (ssize_t) GetQuantumRange(depth); i++)
                    if (pixel.red <= GetQuantumRange(depth))
                      pixel.red=scale[pixel.red];
                    if (pixel.green <= GetQuantumRange(depth))
                      pixel.green=scale[pixel.green];
                    if (pixel.blue <= GetQuantumRange(depth))
                      pixel.blue=scale[pixel.blue];
CVE-2016-5691 (Other, published 2016-12-13T15:59Z)
Description: value: The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact by leveraging lack of validation of (1) pixel.red, (2) pixel.green, and (3) pixel.blue.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
ChangeLog
coders/dcm.c
Commit message: Add additional checks to DCM reader to prevent data-driven faults (bug report from Hanno Böck


Vulnerable code:
      for (i=0; i < (ssize_t) (GetQuantumRange(depth)+1); i++)
                    pixel.red=scale[pixel.red];
                    pixel.green=scale[pixel.green];
                    pixel.blue=scale[pixel.blue];

Fixed code:
  * Add additional checks to DCM reader to prevent data-driven faults (bug
    report from Hanno Böck).
            if (data == (unsigned char *) NULL)
              break;
            if (data == (unsigned char *) NULL)
              break;
      for (i=0; i <= (ssize_t) GetQuantumRange(depth); i++)
                    if (pixel.red <= GetQuantumRange(depth))
                      pixel.red=scale[pixel.red];
                    if (pixel.green <= GetQuantumRange(depth))
                      pixel.green=scale[pixel.green];
                    if (pixel.blue <= GetQuantumRange(depth))
                      pixel.blue=scale[pixel.blue];
CVE-2016-6491 (C, published 2016-12-13T15:59Z)
Description: value: Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in ImageMagick before 6.9.5-4 and 7.x before 7.0.2-6 allows remote attackers to cause a denial of service (out-of-bounds read, memory leak, and crash) via a crafted image.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/property.c
Commit message: Prevent buffer overflow (bug report from Ibrahim el-sayed)


Vulnerable code:

Fixed code:
    if ((count < 0) || ((size_t) count > length))
      {
        length=0; 
        continue;
      }
CVE-2016-6520 (Other, published 2016-12-13T15:59Z)
Description: value: Buffer overflow in MagickCore/enhance.c in ImageMagick before 7.0.2-7 allows remote attackers to have unspecified impact via vectors related to pixel cache morphology.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
ChangeLog
MagickCore/enhance.c
Commit message: Evaluate lazy pixel cache morphology to prevent buffer overflow (bug report from Ibrahim M. El-Sayed)


Vulnerable code:

Fixed code:
2016-07-01  7.0.2-7 Cristy  <quetzlzacatenango@image...>
  * Evaluate lazy pixel cache morphology to prevent buffer overflow (bug report
    from Ibrahim M. El-Sayed).

  if (SyncImagePixelCache(image,exception) == MagickFalse)
    return(MagickFalse);
  if (SyncImagePixelCache(image,exception) == MagickFalse)
    return(MagickFalse);
CVE-2016-6823 (Other, published 2017-01-18T17:59Z)
Description: value: Integer overflow in the BMP coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (crash) via crafted height and width values, which triggers an out-of-bounds write.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
ChangeLog
coders/bmp.c
Commit message: Prevent buffer overflow in BMP coder (bug report from pwchen of tencent).


Vulnerable code:
    bmp_info.image_size=(unsigned int) (bytes_per_line*image->rows);

Fixed code:
2016-08-15  7.0.2-10 Cristy  <quetzlzacatenango@image...>
  * Prevent buffer overflow in BMP coder (bug report from pwchen of tencent).

    if ((image->columns != (signed int) image->columns) ||
        (image->rows != (signed int) image->rows))
      ThrowWriterException(ImageError,"WidthOrHeightExceedsLimit");
    bmp_info.image_size=(unsigned long) (bytes_per_line*image->rows);