CVE-2019-13308 (C, published 2019-07-05T01:15Z)
Description: value: ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow in MagickCore/fourier.c in ComplexImage.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ImageMagick/ImageMagick6
Files changed:
coders/gif.c
magick/fourier.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1595


Vulnerable code:
      next_pixel=MagickFalse;
      displacement=1;
    magick_number_threads(images,complex_images,images->rows,1L)
  for (y=0; y < (ssize_t) images->rows; y++)
    Ar=GetCacheViewVirtualPixels(Ar_view,0,y,
      MagickMax(Ar_image->columns,Cr_image->columns),1,exception);
    Ai=GetCacheViewVirtualPixels(Ai_view,0,y,
      MagickMax(Ai_image->columns,Ci_image->columns),1,exception);
    Br=GetCacheViewVirtualPixels(Br_view,0,y,
      MagickMax(Br_image->columns,Cr_image->columns),1,exception);
    Bi=GetCacheViewVirtualPixels(Bi_view,0,y,
      MagickMax(Bi_image->columns,Ci_image->columns),1,exception);
    for (x=0; x < (ssize_t) images->columns; x++)
          Cr->red=gamma*(Ar->red*Br->red+Ai->red*Bi->red);
          Ci->red=gamma*(Ai->red*Br->red-Ar->red*Bi->red);
          gamma=PerceptibleReciprocal(Br->green*Br->green+Bi->green*Bi->green+
            snr);
          Cr->green=gamma*(Ar->green*Br->green+Ai->green*Bi->green);
          Ci->green=gamma*(Ai->green*Br->green-Ar->green*Bi->green);
          gamma=PerceptibleReciprocal(Br->blue*Br->blue+Bi->blue*Bi->blue+snr);
          Cr->blue=gamma*(Ar->blue*Br->blue+Ai->blue*Bi->blue);
          Ci->blue=gamma*(Ai->blue*Br->blue-Ar->blue*Bi->blue);
              gamma=PerceptibleReciprocal(Br->opacity*Br->opacity+Bi->opacity*
                Bi->opacity+snr);
              Cr->opacity=gamma*(Ar->opacity*Br->opacity+Ai->opacity*
                Bi->opacity);
              Ci->opacity=gamma*(Ai->opacity*Br->opacity-Ar->opacity*
                Bi->opacity);
          Cr->red=sqrt(Ar->red*Ar->red+Ai->red*Ai->red);
          Ci->red=atan2(Ai->red,Ar->red)/(2.0*MagickPI)+0.5;
          Cr->green=sqrt(Ar->green*Ar->green+Ai->green*Ai->green);
          Ci->green=atan2(Ai->green,Ar->green)/(2.0*MagickPI)+0.5;
          Cr->blue=sqrt(Ar->blue*Ar->blue+Ai->blue*Ai->blue);
              Cr->opacity=sqrt(Ar->opacity*Ar->opacity+Ai->opacity*Ai->opacity);
              Ci->opacity=atan2(Ai->opacity,Ar->opacity)/(2.0*MagickPI)+0.5;
          Cr->red=QuantumScale*(Ar->red*Br->red-Ai->red*Bi->red);
          Ci->red=QuantumScale*(Ai->red*Br->red+Ar->red*Bi->red);
          Cr->green=QuantumScale*(Ar->green*Br->green-Ai->green*Bi->green);
          Ci->green=QuantumScale*(Ai->green*Br->green+Ar->green*Bi->green);
          Cr->blue=QuantumScale*(Ar->blue*Br->blue-Ai->blue*Bi->blue);
          Ci->blue=QuantumScale*(Ai->blue*Br->blue+Ar->blue*Bi->blue);
              Cr->opacity=QuantumScale*(Ar->opacity*Br->opacity-Ai->opacity*
                Bi->opacity);
              Ci->opacity=QuantumScale*(Ai->opacity*Br->opacity+Ar->opacity*
                Bi->opacity);
          if (images->matte != MagickFalse)

Fixed code:
      next_pixel=MagickFalse;
      displacement=1;
      if (k < 0)
        continue;
    magick_number_threads(Cr_image,complex_images,Cr_image->rows,1L)
  for (y=0; y < (ssize_t) Cr_image->rows; y++)
    Ar=GetCacheViewVirtualPixels(Ar_view,0,y,Cr_image->columns,1,exception);
    Ai=GetCacheViewVirtualPixels(Ai_view,0,y,Cr_image->columns,1,exception);
    Br=GetCacheViewVirtualPixels(Br_view,0,y,Cr_image->columns,1,exception);
    Bi=GetCacheViewVirtualPixels(Bi_view,0,y,Cr_image->columns,1,exception);
    for (x=0; x < (ssize_t) Cr_image->columns; x++)
          Cr->red=gamma*((double) Ar->red*Br->red+(double) Ai->red*Bi->red);
          Ci->red=gamma*((double) Ai->red*Br->red-(double) Ar->red*Bi->red);
          gamma=PerceptibleReciprocal((double) Br->green*Br->green+(double)
            Bi->green*Bi->green+snr);
          Cr->green=gamma*((double) Ar->green*Br->green+(double)
            Ai->green*Bi->green);
          Ci->green=gamma*((double) Ai->green*Br->green-(double)
            Ar->green*Bi->green);
          gamma=PerceptibleReciprocal((double) Br->blue*Br->blue+(double)
            Bi->blue*Bi->blue+snr);
          Cr->blue=gamma*((double) Ar->blue*Br->blue+(double)
            Ai->blue*Bi->blue);
          Ci->blue=gamma*((double) Ai->blue*Br->blue-(double)
             Ar->blue*Bi->blue);
              gamma=PerceptibleReciprocal((double) Br->opacity*Br->opacity+
                (double) Bi->opacity*Bi->opacity+snr);
              Cr->opacity=gamma*((double) Ar->opacity*Br->opacity+(double)
                Ai->opacity*Bi->opacity);
              Ci->opacity=gamma*((double) Ai->opacity*Br->opacity-(double)
                Ar->opacity*Bi->opacity);
          Cr->red=sqrt((double) Ar->red*Ar->red+(double) Ai->red*Ai->red);
          Ci->red=atan2((double) Ai->red,(double) Ar->red)/(2.0*MagickPI)+0.5;
          Cr->green=sqrt((double) Ar->green*Ar->green+(double)
            Ai->green*Ai->green);
          Ci->green=atan2((double) Ai->green,(double) Ar->green)/
            (2.0*MagickPI)+0.5;
          Cr->blue=sqrt((double) Ar->blue*Ar->blue+(double) Ai->blue*Ai->blue);
              Cr->opacity=sqrt((double) Ar->opacity*Ar->opacity+(double)
                Ai->opacity*Ai->opacity);
              Ci->opacity=atan2((double) Ai->opacity,(double) Ar->opacity)/
                (2.0*MagickPI)+0.5;
          Cr->red=QuantumScale*((double) Ar->red*Br->red-(double)
            Ai->red*Bi->red);
          Ci->red=QuantumScale*((double) Ai->red*Br->red+(double)
            Ar->red*Bi->red);
          Cr->green=QuantumScale*((double) Ar->green*Br->green-(double)
            Ai->green*Bi->green);
          Ci->green=QuantumScale*((double) Ai->green*Br->green+(double)
            Ar->green*Bi->green);
          Cr->blue=QuantumScale*((double) Ar->blue*Br->blue-(double)
            Ai->blue*Bi->blue);
          Ci->blue=QuantumScale*((double) Ai->blue*Br->blue+(double)
            Ar->blue*Bi->blue);
              Cr->opacity=QuantumScale*((double) Ar->opacity*Br->opacity-
                (double) Ai->opacity*Bi->opacity);
              Ci->opacity=QuantumScale*((double) Ai->opacity*Br->opacity+
                (double) Ar->opacity*Bi->opacity);
          if (Cr_image->matte != MagickFalse)