CVE-2017-12664 (C, published 2017-08-07T21:29Z)
Description: value: ImageMagick 7.0.6-2 has a memory leak vulnerability in WritePALMImage in coders/palm.c.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-772 \u2014 Missing Release of Resource after Effective Lifetime
The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/quantize.c
coders/palm.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/574


Vulnerable code:
        ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
          image->filename);
    *lastrow,
    lastrow=(unsigned char *) NULL;
        lastrow=(unsigned char *) AcquireQuantumMemory(MagickMax(bytes_per_row,
          2*image->columns),sizeof(*lastrow));
        if (lastrow == (unsigned char *) NULL)
                    one_row[i+bit]=lastrow[i+bit];
              (void) CopyMagickMemory(lastrow, one_row, bytes_per_row);
                lastrow=(unsigned char *) RelinquishMagickMemory(lastrow);
                  lastrow=(unsigned char *) RelinquishMagickMemory(lastrow);
      lastrow=(unsigned char *) RelinquishMagickMemory(lastrow);
    *lastrow,
    lastrow=(unsigned char *) NULL;
      lastrow=(unsigned char *) AcquireQuantumMemory(bytes_per_row,
        sizeof(*lastrow));
      /* TODO check whether memory really was acquired? */
      ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
                if ((y == 0) || (lastrow[x + bit] != one_row[x + bit]))
            (void) CopyMagickMemory(lastrow,one_row,bytes_per_row);
        (void) WriteBlobByte(image,(unsigned char) ((31*transpix.red)/QuantumRange));
        (void) WriteBlobByte(image,(unsigned char) ((63*transpix.green)/QuantumRange));
        (void) WriteBlobByte(image,(unsigned char) ((31*transpix.blue)/QuantumRange));
    if (lastrow != (unsigned char *) NULL) 
      lastrow=(unsigned char *) RelinquishMagickMemory(lastrow);

Fixed code:
        {
          colormap_index=(ssize_t *) RelinquishMagickMemory(colormap_index);
          ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
            image->filename);
        }
    *last_row,
    last_row=(unsigned char *) NULL;
        last_row=(unsigned char *) AcquireQuantumMemory(MagickMax(bytes_per_row,
          2*image->columns),sizeof(*last_row));
        if (last_row == (unsigned char *) NULL)
                    one_row[i+bit]=last_row[i+bit];
              (void) CopyMagickMemory(last_row, one_row, bytes_per_row);
                last_row=(unsigned char *) RelinquishMagickMemory(last_row);
                  last_row=(unsigned char *) RelinquishMagickMemory(last_row);
      last_row=(unsigned char *) RelinquishMagickMemory(last_row);
    *last_row,
    last_row=(unsigned char *) NULL;
      {
        last_row=(unsigned char *) AcquireQuantumMemory(bytes_per_row,
          sizeof(*last_row));
        if (last_row == (unsigned char *) NULL)
          {
            quantize_info=DestroyQuantizeInfo(quantize_info);
            ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
          }
      }
      {
        quantize_info=DestroyQuantizeInfo(quantize_info);
        ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
      }
                if ((y == 0) || (last_row[x + bit] != one_row[x + bit]))
            (void) CopyMagickMemory(last_row,one_row,bytes_per_row);
        (void) WriteBlobByte(image,(unsigned char) ((31*transpix.red)/
          QuantumRange));
        (void) WriteBlobByte(image,(unsigned char) ((63*transpix.green)/
          QuantumRange));
        (void) WriteBlobByte(image,(unsigned char) ((31*transpix.blue)/
          QuantumRange));
    if (last_row != (unsigned char *) NULL) 
      last_row=(unsigned char *) RelinquishMagickMemory(last_row);