hitoshura25/cvefixes huggingface dataset:
CVE-2016-7101 (C, published 2017-01-18T17:59Z)
Description: value: The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large row value in an sgi file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/sgi.c
Commit message: ...


Vulnerable code:
    (void) ReadBlob(image,sizeof(iris_info.name),(unsigned char *)
    (void) count;
    if (EOFBlob(image) != MagickFalse)
      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
    if ((image_info->ping != MagickFalse)  && (image_info->number_scenes != 0))

Fixed code:
    count=ReadBlob(image,sizeof(iris_info.name),(unsigned char *)
    if (count != sizeof(iris_info.name))
      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
    if (count != sizeof(iris_info.filler))
      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
    if ((image_info->ping != MagickFalse) && (image_info->number_scenes != 0))
CVE-2016-7101 (Other, published 2017-01-18T17:59Z)
Description: value: The SGI coder in ImageMagick before 7.0.2-10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large row value in an sgi file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
ChangeLog
coders/sgi.c
Commit message: Prevent buffer overflow in BMP & SGI coders (bug report from pwchen&rayzhong of tencent)


Vulnerable code:
  * Prevent buffer overflow in BMP coder (bug report from
      image->depth=(size_t) MagickMin((size_t) 8*
        iris_info.bytes_per_pixel,MAGICKCORE_QUANTUM_DEPTH);

Fixed code:
  * Prevent buffer overflow in BMP & SGI coders (bug report from
      image->depth=(size_t) MagickMin((size_t) 8*iris_info.bytes_per_pixel,
        MAGICKCORE_QUANTUM_DEPTH);
    if (EOFBlob(image) != MagickFalse)
      ThrowReaderException(CorruptImageError,"ImproperImageHeader");
CVE-2016-7514 (C, published 2017-04-20T18:59Z)
Description: value: The ReadPSDChannelPixels function in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/psd.c
Commit message: Added missing call to ConstrainColormapIndex.


Vulnerable code:
                    GetPixelIndex(image,q),q);

Fixed code:
                    ConstrainColormapIndex(image,GetPixelIndex(image,q),
                      exception),q);
CVE-2016-7514 (C, published 2017-04-20T18:59Z)
Description: value: The ReadPSDChannelPixels function in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/psd.c
Commit message: Fixed overflow.


Vulnerable code:
      compact_pixels=(unsigned char *) AcquireQuantumMemory(2*channels*
        next_image->columns,packet_size*sizeof(*compact_pixels));

Fixed code:
      compact_pixels=(unsigned char *) AcquireQuantumMemory((2*channels*
        next_image->columns)+1,packet_size*sizeof(*compact_pixels));
CVE-2016-7514 (C, published 2017-04-20T18:59Z)
Description: value: The ReadPSDChannelPixels function in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/psd.c
Commit message: Added check for bit depth 1.


Vulnerable code:

Fixed code:
  if ((image->depth == 1) && (image->storage_class != PseudoClass))
    ThrowReaderException(CorruptImageError, "ImproperImageHeader");
CVE-2016-7515 (C, published 2017-04-19T14:59Z)
Description: value: The ReadRLEImage function in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the number of pixels.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/rle.c
Commit message: Fixed check for the number of pixels that will be allocated.


Vulnerable code:
    if ((number_pixels*number_planes) != (size_t) (number_pixels*number_planes))
    pixel_info_length=image->columns*image->rows*MagickMax(number_planes,4);

Fixed code:
    number_planes_filled,
    number_planes_filled=(number_planes % 2 == 0) ? number_planes :
      number_planes+1;
    if ((number_pixels*number_planes_filled) != (size_t) (number_pixels*
         number_planes_filled))
    pixel_info_length=image->columns*image->rows*number_planes_filled;
CVE-2016-7520 (C, published 2017-04-20T18:59Z)
Description: value: Heap-based buffer overflow in coders/hdr.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted HDR file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/hdr.c
Commit message: https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1537213


Vulnerable code:
      count=FormatLocaleString(header,MagickPathExtent,"GAMMA=%g\n",image->gamma);
  pixels=(unsigned char *) AcquireQuantumMemory(image->columns,4*

Fixed code:
      count=FormatLocaleString(header,MagickPathExtent,"GAMMA=%g\n",
        image->gamma);
  pixels=(unsigned char *) AcquireQuantumMemory(image->columns+128,4*
  (void) ResetMagickMemory(pixels,0,4*(image->columns+128)*sizeof(*pixels));
CVE-2016-7521 (C, published 2017-04-20T18:59Z)
Description: value: Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/psd.c
Commit message: Moved check for https://github.com/ImageMagick/ImageMagick/issues/92.


Vulnerable code:
      CheckNumberCompactPixels;

Fixed code:
      CheckNumberCompactPixels;
CVE-2016-7522 (C, published 2017-04-19T14:59Z)
Description: value: The ReadPSDImage function in MagickCore/locale.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/psd.c
Commit message: Added extra check to fix https://github.com/ImageMagick/ImageMagick/issues/93


Vulnerable code:
      if ((count != (ssize_t) length) ||

Fixed code:
      if ((count != (ssize_t) length) || (length < 4) ||
CVE-2016-7524 (C, published 2020-02-06T14:15Z)
Description: value: coders/meta.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/meta.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/96


Vulnerable code:
                    while (len--)
                    while (len--)

Fixed code:
                    while (len-- > 0)
                    while (len-- > 0)
CVE-2016-7525 (C, published 2017-04-20T18:59Z)
Description: value: Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/psd.c
Commit message: Fixed head buffer overflow reported in: https://github.com/ImageMagick/ImageMagick/issues/98


Vulnerable code:
    return((image->columns+7)/8);

Fixed code:
    return(((image->columns+7)/8)*GetPSDPacketSize(image));
CVE-2016-7526 (C, published 2017-04-20T18:59Z)
Description: value: coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/wpg.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/102


Vulnerable code:
        for (x=0; x < ((ssize_t) image->columns-1); x+=2)

Fixed code:
        for (x=0; x < ((ssize_t) image->columns-1); x+=4)
CVE-2016-7526 (C, published 2017-04-20T18:59Z)
Description: value: coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/wpg.c
Commit message: Fixed out-of-bounds write reported in: https://github.com/ImageMagick/ImageMagick/issues/102


Vulnerable code:
        for (x=0; x < ((ssize_t) image->columns-1); x+=4)
            p++;
            if ((image->columns % 4) >= 1)

                if ((image->columns % 4) >= 2)

      break;     
                        AppendImageToList(&image,flip_image);    
    
      /* rotate command */
                        AppendImageToList(&image,rotate_image);    
                    }                
              image->columns=image->rows=0;
              image->rows=Bitmap2Header1.Height;  
                      BImgBuff=(unsigned char *) RelinquishMagickMemory(BImgBuff);;
                  /* Try to change CTM according to Flip - I am not sure, must be checked.      
                     Tx(1,2)=0;   Tx(2,2)=1; */                  
                     Tx(2,2)=1; */      
              }    
    

Fixed code:
        for (x=0; x < ((ssize_t) image->columns-3); x+=4)
            p++;
            if ((image->columns % 4) > 1)
                if ((image->columns % 4) > 2)
      break;
                        AppendImageToList(&image,flip_image);
                  /* rotate command */
                        AppendImageToList(&image,rotate_image);
                    }
              image->columns=image->rows=1;
              image->rows=Bitmap2Header1.Height;
                      BImgBuff=(unsigned char *) RelinquishMagickMemory(BImgBuff);
                  /* Try to change CTM according to Flip - I am not sure, must be checked.
                     Tx(1,2)=0;   Tx(2,2)=1; */
                     Tx(2,2)=1; */
              }
CVE-2016-7527 (C, published 2017-04-20T18:59Z)
Description: value: coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/wpg.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/122


Vulnerable code:
  (void) CopyMagickMemory(clone_info->magick,magic_info->name,MagickPathExtent);

Fixed code:
  (void) strncpy(clone_info->magick,magic_info->name,MagickPathExtent);
CVE-2016-7528 (C, published 2017-04-19T14:59Z)
Description: value: The ReadVIFFImage function in coders/viff.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted VIFF file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/viff.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/99


Vulnerable code:
    pixels=(unsigned char *) AcquireQuantumMemory(max_packets,
      bytes_per_pixel*sizeof(*pixels));

Fixed code:
    pixels=(unsigned char *) AcquireQuantumMemory(MagickMax(number_pixels,
      max_packets),bytes_per_pixel*sizeof(*pixels));
CVE-2016-7529 (C, published 2017-04-19T14:59Z)
Description: value: coders/xcf.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted XCF file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/xcf.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/104


Vulnerable code:
  xcfdata=(XCFPixelInfo *) AcquireQuantumMemory(data_length,sizeof(*xcfdata));

Fixed code:
  xcfdata=(XCFPixelInfo *) AcquireQuantumMemory(MagickMax(data_length,
    tile_image->columns*tile_image->rows),sizeof(*xcfdata));
CVE-2016-7530 (C, published 2017-04-20T18:59Z)
Description: value: The quantum handling code in ImageMagick allows remote attackers to cause a denial of service (divide-by-zero error or out-of-bounds write) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-369 \u2014 Divide By Zero
The product divides a value by zero.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/quantum.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/105


Vulnerable code:
    return((size_t) (packet_size*image->columns*((quantum_info->depth+7)/8)));
  return((size_t) ((packet_size*image->columns*quantum_info->depth+7)/8));
  extent=image->columns*quantum;
  if ((image->columns != 0) && (quantum != (extent/image->columns)))

Fixed code:
    extent,
  extent=MagickMax(image->columns,image->rows);
    return((size_t) (packet_size*extent*((quantum_info->depth+7)/8)));
  return((size_t) ((packet_size*extent*quantum_info->depth+7)/8));
  extent=MagickMax(image->columns,image->rows)*quantum;
  if ((MagickMax(image->columns,image->rows) != 0) &&
      (quantum != (extent/MagickMax(image->columns,image->rows))))
CVE-2016-7532 (C, published 2017-04-20T18:59Z)
Description: value: coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/psd.c
Commit message: Added check for out of bounds read (https://github.com/ImageMagick/ImageMagick/issues/108).


Vulnerable code:
      break;
    if ((id == 0x000003ed) && (PSDQuantum(count) < (ssize_t) (length-12)))
        (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
          (PSDQuantum(count)+12)-(q-datum));
        SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));
static MagickBooleanType WritePSDImage(const ImageInfo *image_info,Image *image,
  ExceptionInfo *exception)

Fixed code:
    ssize_t
      cnt;

      return;
    cnt=PSDQuantum(count);
    if (cnt < 0)
      return;
    if ((id == 0x000003ed) && (cnt < (ssize_t) (length-12)))
        (void) CopyMagickMemory(q,q+cnt+12,length-(cnt+12)-(q-datum));
        SetStringInfoLength(bim_profile,length-(cnt+12));
static MagickBooleanType WritePSDImage(const ImageInfo *image_info,
  Image *image,ExceptionInfo *exception)
CVE-2016-7533 (C, published 2017-04-19T14:59Z)
Description: value: The ReadWPGImage function in coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WPG file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/wpg.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/120


Vulnerable code:
                      ldblk,sizeof(*BImgBuff));

Fixed code:
                      ldblk+1,sizeof(*BImgBuff));
CVE-2016-7534 (C, published 2017-04-20T18:59Z)
Description: value: The generic decoder in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/quantum-import.c
MagickCore/quantum.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/126


Vulnerable code:
          for (x=0; x < (ssize_t) number_pixels; x+=2)


Fixed code:
          for (x=0; x < (ssize_t) number_pixels; x+=4)
    case CbYCrAQuantum: packet_size=4; break;
    case CbYCrQuantum: packet_size=3; break;
    case CbYCrYQuantum: packet_size=4; break;
CVE-2016-7536 (C, published 2017-04-20T18:59Z)
Description: value: magick/profile.c in ImageMagick allows remote attackers to cause a denial of service (segmentation fault) via a crafted profile.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/profile.c
Commit message: Fixed SEGV reported in https://github.com/ImageMagick/ImageMagick/issues/130


Vulnerable code:
    if ((p > (datum+length-count)) || (count > (ssize_t) length))

Fixed code:
    if ((count < 0) || (p > (datum+length-count)) ||
        (count > (ssize_t) length))
CVE-2016-7537 (C, published 2017-04-19T14:59Z)
Description: value: MagickCore/memory.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds access) via a crafted PDB file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/pdb.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/143


Vulnerable code:
  pixels=(unsigned char *) AcquireQuantumMemory(packets+256UL,image->rows*
  buffer=(unsigned char *) AcquireQuantumMemory(256,sizeof(*buffer));

Fixed code:
  pixels=(unsigned char *) AcquireQuantumMemory(packets+257UL,image->rows*
  buffer=(unsigned char *) AcquireQuantumMemory(257,sizeof(*buffer));
CVE-2016-7538 (C, published 2017-04-20T18:59Z)
Description: value: coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
coders/psd.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/148


Vulnerable code:
        (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
          (PSDQuantum(count)+12)-(q-datum));
        SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));

Fixed code:
        if ((q+PSDQuantum(count)+12) < (datum+length-16))
          {
            (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
              (PSDQuantum(count)+12)-(q-datum));
            SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));
          }
CVE-2016-7799 (C, published 2017-01-18T17:59Z)
Description: value: MagickCore/profile.c in ImageMagick before 7.0.3-2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/profile.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/280


Vulnerable code:
      if ((format-1) >= EXIF_NUM_FORMATS)

Fixed code:
      if ((format < 0) || ((format-1) >= EXIF_NUM_FORMATS))
CVE-2016-7906 (C, published 2017-01-18T17:59Z)
Description: value: magick/attribute.c in ImageMagick 7.0.3-2 allows remote attackers to cause a denial of service (use-after-free) via a crafted file.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/attribute.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/281


Vulnerable code:
      image->colors=2;

Fixed code:
      status=AcquireImageColormap(image,2,exception);
CVE-2016-9298 (C, published 2017-01-27T22:59Z)
Description: value: Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6-4 and 7.x before 7.0.3-6 allows remote attackers to cause a denial of service (crash) via a crafted image.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/fx.c
PerlMagick/demo/demo.pl
Commit message: https://github.com/ImageMagick/ImageMagick/issues/296


Vulnerable code:
  kernel=(float *) AcquireQuantumMemory(MagickMax(image->rows,image->columns),
$example->Label('WaveletDenoise');

Fixed code:
  kernel=(float *) AcquireQuantumMemory(MagickMax(image->rows,image->columns)+1,
$example->Label('Wavelet Denoise');