hitoshura25/cvefixes huggingface dataset:
CVE-2023-27114 (Other, published 2023-03-10T02:15Z)
Description: value: radare2 v5.8.3 was discovered to contain a segmentation fault via the component wasm_dis at p/wasm/wasm.c.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/arch/p/wasm/wasm.c
test/db/anal/wasm
Commit message: Fix #21363 - null deref in the wasm disassembler ##crash


Vulnerable code:
/* radare - LGPL - Copyright 2017-2022 - pancake, cgvwzq */
#include <r_asm.h>
#include <r_lib.h>
#include <string.h>

			if (txt) {
				if (txt) {
				if (txt) {
				if (txt) {
				if (txt) {
				if (txt) {
				if (txt) {
				if (txt) {
				if (txt) {
				if (txt) {
				if (txt) {
				if (txt) {
				if (txt) {
			if (txt) {
				if (txt) {
						opdef->txt, bytes[0], bytes[1], bytes[2], bytes[3],
				if (txt) {

Fixed code:
/* radare - LGPL - Copyright 2017-2023 - pancake, cgvwzq */
#include <r_arch.h>
			if (txt && opdef->txt) {
				if (txt && opdef->txt) {
				if (txt && opdef->txt) {
				if (txt && opdef->txt) {
				if (txt && opdef->txt) {
				if (txt && opdef->txt) {
				if (txt && opdef->txt) {
				if (txt && opdef->txt) {
				if (txt && opdef->txt) {
				if (txt && opdef->txt) {
				if (txt && opdef->txt) {
				if (txt && opdef->txt) {
				if (txt && opdef->txt) {
			if (txt && opdef->txt) {
				if (txt && opdef->txt) {
						r_str_get (opdef->txt), bytes[0], bytes[1], bytes[2], bytes[3],
				if (txt && opdef->txt) {
	if (txt && !op->txt) {
		op->txt = strdup ("incorrect");
	}
NAME=wasm crash test
FILE=bins/wasm/nullderef.wasm
CMDS=<<EOF
pd 10
EOF
EXPECT=<<EOF
            ;-- entry0:
            ;-- fcn.0:
            0x000000be      4185feff77     i32.const 251657989
            0x000000c3      fd0f           i8x16.splat
            0x000000c5      fda001         incorrect
            0x000000c8      fd64           incorrect
            0x000000ca      0b             end
            0x000000cb      00             trap
            0x000000cc      00             trap
            0x000000cd      00             trap
            0x000000ce      00             trap
            0x000000cf      00             trap
EOF
EXPECT_ERR=<<EOF
ERROR: unknown section id: 13
ERROR: unknown section id: 109
EOF
RUN
CVE-2023-4322 (C, published 2023-08-14T16:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/arch/p/bf/plugin.c
libr/core/cmd_anal.c
Commit message: Fix 1byte heap oobread in the brainfuck disassembler

* https://huntr.dev/bounties/06e2484c-d6f1-4497-af67-26549be9fffd/
* Kudos to @7resp4ss for reporting


Vulnerable code:
	const char *keys = "[]<>+-,.";
	const char *cidx = strchr (keys, ch);
	const ut8 *_buf = op->bytes;
	const ut64 addr = op->addr;

	ut8 *buf = (ut8*)_buf; // XXX
		{
				if (*p == '[') {
				}
				if (*p == ']') {
					if (lev == -1) {
						dst = addr + (size_t)(p - buf) + 1;
				}
				if (*p == 0x00 || *p == 0xff) {
					break;
					ut8 buf[4] = {0};
					r_io_read_at (core->io, op.jump, buf, 4);
					isValidCall = memcmp (buf, "\x00\x00\x00\x00", 4);
	char *out = (input[0] == ' ')
		? sdb_querys (db, NULL, 0, input + 1)
		: sdb_querys (db, NULL, 0, "*");
	RAnalFunction * fcn = r_anal_get_function_at (core->anal, addr);


Fixed code:
	const char *const keys = "[]<>+-,.";
	const char *const cidx = strchr (keys, ch);
	ut8 *buf = op->bytes;
	const ut64 addr = op->addr;
		if (len > 1) {
				switch (*p) {
				case '[':
					break;
				case ']':
					if (lev < 1) {
						size_t delta = p - buf;
						dst = addr + (size_t)delta + 1;
					break;
				case 0:
				case 0xff:
#if 0
#else
					break;
#endif
					ut8 zbuf[4] = {0};
					r_io_read_at (core->io, op.jump, zbuf, 4);
					isValidCall = memcmp (zbuf, "\x00\x00\x00\x00", 4);
	const char *arg = (input[0] == ' ')? input + 1: "*";
	char *out = sdb_querys (db, NULL, 0, arg);
	RAnalFunction *fcn = r_anal_get_function_at (core->anal, addr);
CVE-2023-47016 (C, published 2023-11-22T07:15Z)
Description: value: radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
libr/bin/p/bin_xnu_kernelcache.c
Commit message: Fix #22349 - oobread in xnu kernelcache ##crash

* Reproducer rabin_hbo_194
* Reported by @gandalf4a


Vulnerable code:
		for (j = 0; j < section->size; j += 8) {

Fixed code:
		for (j = 0; j + 7 < section->size; j += 8) {
CVE-2023-5686 (C, published 2023-10-20T17:15Z)
Description: value: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/radareorg/radare2
Files changed:
shlr/java/code.c
Commit message: Fix oobread in the java disassembler ##asan

* Causes UB when performing analysis, not exploitable
* https://huntr.com/bounties/bbfe1f76-8fa1-4a8c-909d-65b16e970be0/
* Reported by @gandalf4a


Vulnerable code:
		if (len > 1) {
			snprintf (output, outlen, "%s 0x%04"PFMT64x, JAVA_OPS[idx].name,
					(addr + (short)USHORT (bytes, 1)));

Fixed code:
		if (len > 3) {
			const short delta = USHORT (bytes, 1);
			snprintf (output, outlen, "%s 0x%04"PFMT64x, JAVA_OPS[idx].name, addr + delta);
CVE-2018-16749 (C, published 2018-09-09T15:29Z)
Description: value: In ImageMagick 7.0.7-29 and earlier, a missing NULL check in ReadOneJNGImage in coders/png.c allows an attacker to cause a denial of service (WriteBlob assertion failure and application exit) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/png.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1119


Vulnerable code:
        if (length != 0)

Fixed code:
        if ((length != 0) && (color_image != (Image *) NULL))
CVE-2019-11472 (C, published 2019-04-23T14:29Z)
Description: value: ReadXWDImage in coders/xwd.c in the XWD image parsing component of ImageMagick 7.0.8-41 Q16 allows attackers to cause a denial-of-service (divide-by-zero error) by crafting an XWD image file in which the header indicates neither LSB first nor MSB first.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/xwd.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1546


Vulnerable code:

Fixed code:
  if ((header.bitmap_bit_order != MSBFirst) &&
      (header.bitmap_bit_order != LSBFirst))
    ThrowReaderException(CorruptImageError,"ImproperImageHeader");
CVE-2019-13135 (C, published 2019-07-01T20:15Z)
Description: value: ImageMagick before 7.0.8-50 has a "use of uninitialized value" vulnerability in the function ReadCUTImage in coders/cut.c.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-908 \u2014 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/cut.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1599


Vulnerable code:

Fixed code:
  (void) memset(BImgBuff,0,(size_t) ldblk*sizeof(*BImgBuff));
CVE-2019-13137 (C, published 2019-07-01T20:15Z)
Description: value: ImageMagick before 7.0.8-50 has a memory leak vulnerability in the function ReadPSImage in coders/ps.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/ps.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1601


Vulnerable code:

Fixed code:
          geometry=DestroyString(geometry);
CVE-2019-13295 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a width of zero is mishandled.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
magick/threshold.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1608


Vulnerable code:

Fixed code:
  if (width == 0)
    return(threshold_image);
CVE-2019-13297 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read at MagickCore/threshold.c in AdaptiveThresholdImage because a height of zero is mishandled.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
magick/threshold.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1609


Vulnerable code:
  if (width == 0)

Fixed code:
  if ((width == 0) || (height == 0))
CVE-2019-13300 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
magick/statistic.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1586


Vulnerable code:
static MagickPixelPacket **AcquirePixelThreadSet(const Image *image)
    pixels[i]=(MagickPixelPacket *) AcquireQuantumMemory(image->columns,
    for (j=0; j < (ssize_t) image->columns; j++)
      GetMagickPixelPacket(image,&pixels[i][j]);

Fixed code:
static MagickPixelPacket **AcquirePixelThreadSet(const Image *images)
  const Image
    *next;

    columns,
  columns=images->columns;
  for (next=images; next != (Image *) NULL; next=next->next)
    columns=MagickMax(next->columns,columns);
    pixels[i]=(MagickPixelPacket *) AcquireQuantumMemory(columns,
    for (j=0; j < (ssize_t) columns; j++)
      GetMagickPixelPacket(images,&pixels[i][j]);
CVE-2019-13304 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced assignment.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/pnm.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1614


Vulnerable code:
            *q++=' ';

Fixed code:
            *q++=' ';
CVE-2019-13305 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/pnm.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1613


Vulnerable code:
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            if ((q-pixels+extent+2) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            if ((q-pixels+extent+2) >= sizeof(pixels))

Fixed code:
            if ((q-pixels+extent+1) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            if ((q-pixels+extent+1) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
CVE-2019-13305 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of a misplaced strncpy and an off-by-one error.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/pnm.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1613


Vulnerable code:
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            if ((q-pixels+extent+2) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            if ((q-pixels+extent+2) >= sizeof(pixels))

Fixed code:
            if ((q-pixels+extent+1) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
            if ((q-pixels+extent+1) >= sizeof(pixels))
            (void) strncpy((char *) q,buffer,extent);
            q+=extent;
CVE-2019-13306 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/pnm.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1612


Vulnerable code:
            if ((q-pixels+extent+1) >= sizeof(pixels))
            if ((q-pixels+extent+1) >= sizeof(pixels))

Fixed code:
            if ((q-pixels+extent+2) >= sizeof(pixels))
            if ((q-pixels+extent+2) >= sizeof(pixels))
CVE-2019-13306 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a stack-based buffer overflow at coders/pnm.c in WritePNMImage because of off-by-one errors.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/pnm.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1612


Vulnerable code:
            if ((q-pixels+extent+1) >= sizeof(pixels))
            if ((q-pixels+extent+1) >= sizeof(pixels))

Fixed code:
            if ((q-pixels+extent+2) >= sizeof(pixels))
            if ((q-pixels+extent+2) >= sizeof(pixels))
CVE-2019-13307 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling rows.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
magick/statistic.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1615


Vulnerable code:
    number_threads;
  number_threads=(size_t) GetMagickResourceLimit(ThreadResource);
  pixels=(MagickPixelPacket **) AcquireQuantumMemory(number_threads,
    sizeof(*pixels));
  (void) memset(pixels,0,number_threads*sizeof(*pixels));
  for (i=0; i < (ssize_t) number_threads; i++)

Fixed code:
    rows;
  rows=MagickMax(GetImageListLength(images),
    (size_t) GetMagickResourceLimit(ThreadResource));
  pixels=(MagickPixelPacket **) AcquireQuantumMemory(rows,sizeof(*pixels));
  for (i=0; i < (ssize_t) rows; i++)
CVE-2019-13309 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of mishandling the NoSuchImage error in CLIListOperatorImages in MagickWand/operation.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
wand/mogrify.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1616


Vulnerable code:

Fixed code:
            reconstruct_image=DestroyImage(reconstruct_image);
            image=DestroyImage(image);
                       p=DestroyImage(p);
CVE-2019-13310 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of an error in MagickWand/mogrify.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
wand/mogrify.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1616


Vulnerable code:

Fixed code:
            reconstruct_image=DestroyImage(reconstruct_image);
            image=DestroyImage(image);
                       p=DestroyImage(p);
CVE-2019-13311 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has memory leaks at AcquireMagickMemory because of a wand/mogrify.c error.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
wand/mogrify.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1623


Vulnerable code:
            const char
              *option;


Fixed code:
                (void) ThrowMagickException(exception,GetMagickModule(),
                  OptionError,"ImageSequenceRequired","`%s'",option);
                image=DestroyImage(image);
                (void) ThrowMagickException(exception,GetMagickModule(),
                  OptionError,"ImageSequenceRequired","`%s'",option);
                image=DestroyImage(image);
                (void) ThrowMagickException(exception,GetMagickModule(),
                  OptionError,"ImageSequenceRequired","`%s'",option);
                image=DestroyImage(image);
                (void) ThrowMagickException(exception,GetMagickModule(),
                  OptionError,"ImageSequenceRequired","`%s'",option);
                image=DestroyImage(image);
                (void) ThrowMagickException(exception,GetMagickModule(),
                  OptionError,"ImageSequenceRequired","`%s'",option);
                magnitude_image=DestroyImage(magnitude_image);
            magnitude_image=DestroyImage(magnitude_image);
            phase_image=DestroyImage(phase_image);
CVE-2019-13391 (C, published 2019-07-07T22:15Z)
Description: value: In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
magick/annotate.c
magick/fourier.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1588


Vulnerable code:
    Ar=GetCacheViewVirtualPixels(Ar_view,0,y,Ar_image->columns,1,exception);
    Ai=GetCacheViewVirtualPixels(Ai_view,0,y,Ai_image->columns,1,exception);
    Br=GetCacheViewVirtualPixels(Br_view,0,y,Br_image->columns,1,exception);
    Bi=GetCacheViewVirtualPixels(Bi_view,0,y,Bi_image->columns,1,exception);

Fixed code:
      text=DestroyString(text);
      text=DestroyString(text);
  text=DestroyString(text);
    Ar=GetCacheViewVirtualPixels(Ar_view,0,y,
      MagickMax(Ar_image->columns,Cr_image->columns),1,exception);
    Ai=GetCacheViewVirtualPixels(Ai_view,0,y,
      MagickMax(Ai_image->columns,Ci_image->columns),1,exception);
    Br=GetCacheViewVirtualPixels(Br_view,0,y,
      MagickMax(Br_image->columns,Cr_image->columns),1,exception);
    Bi=GetCacheViewVirtualPixels(Bi_view,0,y,
      MagickMax(Bi_image->columns,Ci_image->columns),1,exception);
CVE-2019-13454 (C, published 2019-07-09T17:15Z)
Description: value: ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
magick/layer.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1629


Vulnerable code:
MagickExport void RemoveDuplicateLayers(Image **images,
     ExceptionInfo *exception)
  register Image
    *curr,
    *next;

    (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",(*images)->filename);

  curr=GetFirstImageInList(*images);
  for (; (next=GetNextImageInList(curr)) != (Image *) NULL; curr=next)
    if ( curr->columns != next->columns || curr->rows != next->rows
         || curr->page.x != next->page.x || curr->page.y != next->page.y )
    bounds=CompareImageBounds(curr,next,CompareAnyLayer,exception);
    if ( bounds.x < 0 ) {
      /*
        the two images are the same, merge time delays and delete one.
      */
      size_t time;
      time = curr->delay*1000/curr->ticks_per_second;
      time += next->delay*1000/next->ticks_per_second;
      next->ticks_per_second = 100L;
      next->delay = time*curr->ticks_per_second/1000;
      next->iterations = curr->iterations;
      *images = curr;
      (void) DeleteImageFromList(images);
    }
  *images = GetFirstImageInList(*images);

Fixed code:
MagickExport void RemoveDuplicateLayers(Image **images,ExceptionInfo *exception)
  register Image
    *image,
    *next;

    (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",
      (*images)->filename);
  image=GetFirstImageInList(*images);
  for ( ; (next=GetNextImageInList(image)) != (Image *) NULL; image=next)
    if ((image->columns != next->columns) || (image->rows != next->rows) ||
        (image->page.x != next->page.x) || (image->page.y != next->page.y))
    bounds=CompareImageBounds(image,next,CompareAnyLayer,exception);
    if (bounds.x < 0)
      {
        /*
          Two images are the same, merge time delays and delete one.
        */
        size_t
          time;

        time=1000*image->delay*PerceptibleReciprocal(image->ticks_per_second);
        time+=1000*next->delay*PerceptibleReciprocal(next->ticks_per_second);
        next->ticks_per_second=100L;
        next->delay=time*image->ticks_per_second/1000;
        next->iterations=image->iterations;
        *images=image;
        (void) DeleteImageFromList(images);
      }
  *images=GetFirstImageInList(*images);