CVE-2015-8895 (C, published 2017-03-15T19:59Z)
Description: value: Integer overflow in coders/icon.c in ImageMagick 6.9.1-3 and later allows remote attackers to cause a denial of service (application crash) via a crafted length value, which triggers a buffer overflow.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/ImageMagick/ImageMagick
Files changed:
MagickCore/memory.c
MagickCore/studio.h
MagickCore/version.c
MagickCore/version.h
MagickWand/studio.h
coders/icon.c
coders/pict.c
configure
configure.ac

Vulnerable code:
  if (memory_info->blob == NULL)
      if (file != -1)
          if ((lseek(file,length-1,SEEK_SET) >= 0) && (write(file,"",1) == 1))
              memory_info->blob=MapBlob(file,IOMode,0,length);
              if (memory_info->blob != NULL)
                  memory_info->type=MapVirtualMemory;
                  (void) AcquireMagickResource(MapResource,length);
          (void) RelinquishUniqueFileResource(memory_info->filename);
#if defined(_magickcore_restrict) && !defined(restrict)
# define restrict  _magickcore_restrict
#endif
#if defined(MAGICKCORE_BUILD_MODULES) || defined(_DLL)
  " Modules"
#define MagickSVNRevision  "18658:18662M"
#define MagickReleaseDate  "2015-05-26"
#define MagickFeatures "DPC HDRI OpenMP"
#if defined(_magickcore_restrict) && !defined(restrict)
# define restrict  _magickcore_restrict
#endif
    if (p == q || size < 16 || size > 256)
        return((Image *) NULL);
    row_bytes,
  row_bytes=(unsigned short) (image->columns | 0x8000);
      row_bytes=(unsigned short) ((4*image->columns) | 0x8000);
MAGICK_SVN_REVISION=18658:18662M
    MAGICK_FEATURES="Zero-Configuration $MAGICK_FEATURES"
    MAGICK_DEP_LIBS="$USER_LIBS $JBIG_LIBS $LCMS_LIBS $TIFF_LIBS $FREETYPE_LIBS $JPEG_LIBS $GS_LIBS $LQR_LIBS $PNG_LIBS $AUTOTRACE_LIBS $DJVU_LIBS $FFTW_LIBS $FPX_LIBS $FONTCONFIG_LIBS $WEBP_LIBS $WMF_LIBS $DPS_LIBS $XEXT_LIBS $XT_LIBS $IPC_LIBS $X11_LIBS $LZMA_LIBS $BZLIB_LIBS $OPENEXR_LIBS $OPENJPEG_LIBS $PANGO_LIBS $RSVG_LIBS $XML_LIBS $GVC_LIBS $ZLIB_LIBS $GDI32_LIBS $MATH_LIBS $GOMP_LIBS $CL_LIBS $UMEM_LIBS $JEMALLOC_LIBS $THREAD_LIBS"
    MAGICK_FEATURES="Zero-Configuration $MAGICK_FEATURES"
    MAGICK_DEP_LIBS="$USER_LIBS $JBIG_LIBS $LCMS_LIBS $TIFF_LIBS $FREETYPE_LIBS $JPEG_LIBS $GS_LIBS $LQR_LIBS $PNG_LIBS $AUTOTRACE_LIBS $DJVU_LIBS $FFTW_LIBS $FPX_LIBS $FONTCONFIG_LIBS $WEBP_LIBS $WMF_LIBS $DPS_LIBS $XEXT_LIBS $XT_LIBS $IPC_LIBS $X11_LIBS $LZMA_LIBS $BZLIB_LIBS $OPENEXR_LIBS $OPENJPEG_LIBS $PANGO_LIBS $RSVG_LIBS $XML_LIBS $GVC_LIBS $ZLIB_LIBS $GDI32_LIBS $MATH_LIBS $GOMP_LIBS $CL_LIBS $UMEM_LIBS $JEMALLOC_LIBS $THREAD_LIBS"

Fixed code:
  if ((memory_info->blob == NULL) &&
      (AcquireMagickResource(DiskResource,length) != MagickFalse))
      if (file == -1)
        RelinquishMagickResource(DiskResource,length);
      else
          if ((lseek(file,length-1,SEEK_SET) < 0) || (write(file,"",1) != 1))
            RelinquishMagickResource(DiskResource,length);
          else
              if (AcquireMagickResource(MapResource,length) == MagickFalse)
                RelinquishMagickResource(DiskResource,length);
              else
                  memory_info->blob=MapBlob(file,IOMode,0,length);
                  if (memory_info->blob != NULL)
                    memory_info->type=MapVirtualMemory;
                  else
                    {
                      RelinquishMagickResource(MapResource,length);
                      RelinquishMagickResource(DiskResource,length);
                    }
          {
            (void) RelinquishUniqueFileResource(memory_info->filename);
            RelinquishMagickResource(DiskResource,memory_info->length);
          }
#if defined(_magickcore_restrict) && !defined(restrict)
# define restrict  _magickcore_restrict
#endif
#if defined(MAGICKCORE_WINDOWS_SUPPORT) && defined(_DEBUG)
  " Debug"
#endif
#if defined(MAGICKCORE_CIPHER_SUPPORT)
  " Cipher"
#if defined(MAGICKCORE_BUILD_MODULES) || defined(_DLL)
  " Modules"
#endif
#endif
#if defined(ZERO_CONFIGURATION_SUPPORT)
  " Zero-configuration"
#define MagickSVNRevision  "18670M"
#define MagickReleaseDate  "2015-05-29"
#define MagickFeatures "DPC HDRI Cipher OpenMP"
#if defined(_magickcore_restrict) && !defined(restrict)
# define restrict  _magickcore_restrict
#endif
    if ((p == q) || (size < 16) || (size > 256))
      return((Image *) NULL);
        if (~length < 16)
          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
    row_bytes,
  row_bytes=image->columns;
      row_bytes=4*image->columns;
MAGICK_SVN_REVISION=18670M
    MAGICK_FEATURES="Cipher $MAGICK_FEATURES"
    MAGICK_FEATURES="Zero-configuration $MAGICK_FEATURES"
    MAGICK_DEP_LIBS="$USER_LIBS $JBIG_LIBS $LCMS_LIBS $TIFF_LIBS $FREETYPE_LIBS $JPEG_LIBS $GS_LIBS $LQR_LIBS $PNG_LIBS $AUTOTRACE_LIBS $DJVU_LIBS $FFTW_LIBS $FPX_LIBS $FONTCONFIG_LIBS $WEBP_LIBS $WMF_LIBS $DPS_LIBS $XEXT_LIBS $XT_LIBS $IPC_LIBS $X11_LIBS $LZMA_LIBS $BZLIB_LIBS $OPENEXR_LIBS $LIBOPENJP2_LIB $PANGO_LIBS $RSVG_LIBS $XML_LIBS $GVC_LIBS $ZLIB_LIBS $GDI32_LIBS $MATH_LIBS $GOMP_LIBS $CL_LIBS $UMEM_LIBS $JEMALLOC_LIBS $THREAD_LIBS"
    MAGICK_FEATURES="Cipher $MAGICK_FEATURES"
    MAGICK_FEATURES="Zero-configuration $MAGICK_FEATURES"
    MAGICK_DEP_LIBS="$USER_LIBS $JBIG_LIBS $LCMS_LIBS $TIFF_LIBS $FREETYPE_LIBS $JPEG_LIBS $GS_LIBS $LQR_LIBS $PNG_LIBS $AUTOTRACE_LIBS $DJVU_LIBS $FFTW_LIBS $FPX_LIBS $FONTCONFIG_LIBS $WEBP_LIBS $WMF_LIBS $DPS_LIBS $XEXT_LIBS $XT_LIBS $IPC_LIBS $X11_LIBS $LZMA_LIBS $BZLIB_LIBS $OPENEXR_LIBS $LIBOPENJP2_LIB $PANGO_LIBS $RSVG_LIBS $XML_LIBS $GVC_LIBS $ZLIB_LIBS $GDI32_LIBS $MATH_LIBS $GOMP_LIBS $CL_LIBS $UMEM_LIBS $JEMALLOC_LIBS $THREAD_LIBS"