CVE-2015-8896 (C, published 2017-03-15T19:59Z)
Description: value: Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted .pict file.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/memory.c
MagickCore/studio.h
MagickCore/version.c
MagickCore/version.h
MagickWand/studio.h
coders/icon.c
coders/pict.c
configure
configure.ac

Vulnerable code:
  if (memory_info->blob == NULL)
      if (file != -1)
          if ((lseek(file,length-1,SEEK_SET) >= 0) && (write(file,"",1) == 1))
              memory_info->blob=MapBlob(file,IOMode,0,length);
              if (memory_info->blob != NULL)
                  memory_info->type=MapVirtualMemory;
                  (void) AcquireMagickResource(MapResource,length);
          (void) RelinquishUniqueFileResource(memory_info->filename);
#if defined(_magickcore_restrict) && !defined(restrict)
# define restrict  _magickcore_restrict
#endif
#if defined(MAGICKCORE_BUILD_MODULES) || defined(_DLL)
  " Modules"
#define MagickSVNRevision  "18658:18662M"
#define MagickReleaseDate  "2015-05-26"
#define MagickFeatures "DPC HDRI OpenMP"
#if defined(_magickcore_restrict) && !defined(restrict)
# define restrict  _magickcore_restrict
#endif
    if (p == q || size < 16 || size > 256)
        return((Image *) NULL);
    row_bytes,
  row_bytes=(unsigned short) (image->columns | 0x8000);
      row_bytes=(unsigned short) ((4*image->columns) | 0x8000);
MAGICK_SVN_REVISION=18658:18662M
    MAGICK_FEATURES="Zero-Configuration $MAGICK_FEATURES"
    MAGICK_DEP_LIBS="$USER_LIBS $JBIG_LIBS $LCMS_LIBS $TIFF_LIBS $FREETYPE_LIBS $JPEG_LIBS $GS_LIBS $LQR_LIBS $PNG_LIBS $AUTOTRACE_LIBS $DJVU_LIBS $FFTW_LIBS $FPX_LIBS $FONTCONFIG_LIBS $WEBP_LIBS $WMF_LIBS $DPS_LIBS $XEXT_LIBS $XT_LIBS $IPC_LIBS $X11_LIBS $LZMA_LIBS $BZLIB_LIBS $OPENEXR_LIBS $OPENJPEG_LIBS $PANGO_LIBS $RSVG_LIBS $XML_LIBS $GVC_LIBS $ZLIB_LIBS $GDI32_LIBS $MATH_LIBS $GOMP_LIBS $CL_LIBS $UMEM_LIBS $JEMALLOC_LIBS $THREAD_LIBS"
    MAGICK_FEATURES="Zero-Configuration $MAGICK_FEATURES"
    MAGICK_DEP_LIBS="$USER_LIBS $JBIG_LIBS $LCMS_LIBS $TIFF_LIBS $FREETYPE_LIBS $JPEG_LIBS $GS_LIBS $LQR_LIBS $PNG_LIBS $AUTOTRACE_LIBS $DJVU_LIBS $FFTW_LIBS $FPX_LIBS $FONTCONFIG_LIBS $WEBP_LIBS $WMF_LIBS $DPS_LIBS $XEXT_LIBS $XT_LIBS $IPC_LIBS $X11_LIBS $LZMA_LIBS $BZLIB_LIBS $OPENEXR_LIBS $OPENJPEG_LIBS $PANGO_LIBS $RSVG_LIBS $XML_LIBS $GVC_LIBS $ZLIB_LIBS $GDI32_LIBS $MATH_LIBS $GOMP_LIBS $CL_LIBS $UMEM_LIBS $JEMALLOC_LIBS $THREAD_LIBS"

Fixed code:
  if ((memory_info->blob == NULL) &&
      (AcquireMagickResource(DiskResource,length) != MagickFalse))
      if (file == -1)
        RelinquishMagickResource(DiskResource,length);
      else
          if ((lseek(file,length-1,SEEK_SET) < 0) || (write(file,"",1) != 1))
            RelinquishMagickResource(DiskResource,length);
          else
              if (AcquireMagickResource(MapResource,length) == MagickFalse)
                RelinquishMagickResource(DiskResource,length);
              else
                  memory_info->blob=MapBlob(file,IOMode,0,length);
                  if (memory_info->blob != NULL)
                    memory_info->type=MapVirtualMemory;
                  else
                    {
                      RelinquishMagickResource(MapResource,length);
                      RelinquishMagickResource(DiskResource,length);
                    }
          {
            (void) RelinquishUniqueFileResource(memory_info->filename);
            RelinquishMagickResource(DiskResource,memory_info->length);
          }
#if defined(_magickcore_restrict) && !defined(restrict)
# define restrict  _magickcore_restrict
#endif
#if defined(MAGICKCORE_WINDOWS_SUPPORT) && defined(_DEBUG)
  " Debug"
#endif
#if defined(MAGICKCORE_CIPHER_SUPPORT)
  " Cipher"
#if defined(MAGICKCORE_BUILD_MODULES) || defined(_DLL)
  " Modules"
#endif
#endif
#if defined(ZERO_CONFIGURATION_SUPPORT)
  " Zero-configuration"
#define MagickSVNRevision  "18670M"
#define MagickReleaseDate  "2015-05-29"
#define MagickFeatures "DPC HDRI Cipher OpenMP"
#if defined(_magickcore_restrict) && !defined(restrict)
# define restrict  _magickcore_restrict
#endif
    if ((p == q) || (size < 16) || (size > 256))
      return((Image *) NULL);
        if (~length < 16)
          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
    row_bytes,
  row_bytes=image->columns;
      row_bytes=4*image->columns;
MAGICK_SVN_REVISION=18670M
    MAGICK_FEATURES="Cipher $MAGICK_FEATURES"
    MAGICK_FEATURES="Zero-configuration $MAGICK_FEATURES"
    MAGICK_DEP_LIBS="$USER_LIBS $JBIG_LIBS $LCMS_LIBS $TIFF_LIBS $FREETYPE_LIBS $JPEG_LIBS $GS_LIBS $LQR_LIBS $PNG_LIBS $AUTOTRACE_LIBS $DJVU_LIBS $FFTW_LIBS $FPX_LIBS $FONTCONFIG_LIBS $WEBP_LIBS $WMF_LIBS $DPS_LIBS $XEXT_LIBS $XT_LIBS $IPC_LIBS $X11_LIBS $LZMA_LIBS $BZLIB_LIBS $OPENEXR_LIBS $LIBOPENJP2_LIB $PANGO_LIBS $RSVG_LIBS $XML_LIBS $GVC_LIBS $ZLIB_LIBS $GDI32_LIBS $MATH_LIBS $GOMP_LIBS $CL_LIBS $UMEM_LIBS $JEMALLOC_LIBS $THREAD_LIBS"
    MAGICK_FEATURES="Cipher $MAGICK_FEATURES"
    MAGICK_FEATURES="Zero-configuration $MAGICK_FEATURES"
    MAGICK_DEP_LIBS="$USER_LIBS $JBIG_LIBS $LCMS_LIBS $TIFF_LIBS $FREETYPE_LIBS $JPEG_LIBS $GS_LIBS $LQR_LIBS $PNG_LIBS $AUTOTRACE_LIBS $DJVU_LIBS $FFTW_LIBS $FPX_LIBS $FONTCONFIG_LIBS $WEBP_LIBS $WMF_LIBS $DPS_LIBS $XEXT_LIBS $XT_LIBS $IPC_LIBS $X11_LIBS $LZMA_LIBS $BZLIB_LIBS $OPENEXR_LIBS $LIBOPENJP2_LIB $PANGO_LIBS $RSVG_LIBS $XML_LIBS $GVC_LIBS $ZLIB_LIBS $GDI32_LIBS $MATH_LIBS $GOMP_LIBS $CL_LIBS $UMEM_LIBS $JEMALLOC_LIBS $THREAD_LIBS"