Vulnerability: An issue was discovered in ImageMagick 6.9.7. Incorrect TGA files could trigger assertion failures, thus leading to DoS.
Vulnerability ID: CVE-2017-6498
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-03-06
File: coders/tga.c
Commit message: https://github.com/ImageMagick/ImageMagick/pull/359
Commit author: Cristy

Vulnerable version (before fix):
 static MagickBooleanType WriteTGAImage(const ImageInfo *image_info,Image *image)     compression;    const char     *value;    const double static MagickBooleanType WriteTGAImage(const ImageInfo *image_info,Image *image)     compression=image_info->compression;   range=GetQuantumRange(5UL);   tga_info.id_length=0;   value=GetImageProperty(image,"comment");   if (value != (const char *) NULL)     tga_info.id_length=(unsigned char) MagickMin(strlen(value),255);   tga_info.colormap_type=0;   tga_info.colormap_index=0;   tga_info.colormap_length=0; static MagickBooleanType WriteTGAImage(const ImageInfo *image_info,Image *image)   (void) WriteBlobByte(image,tga_info.bits_per_pixel);   (void) WriteBlobByte(image,tga_info.attributes);   if (tga_info.id_length != 0)     (void) WriteBlob(image,tga_info.id_length,(unsigned char *) value);   if (tga_info.colormap_type != 0)     {       unsigned char

Fixed version (after fix):
 static MagickBooleanType WriteTGAImage(const ImageInfo *image_info,Image *image)     compression;    const char     *comment,     *value;    const double static MagickBooleanType WriteTGAImage(const ImageInfo *image_info,Image *image)     compression=image_info->compression;   range=GetQuantumRange(5UL);   tga_info.id_length=0;   comment=GetImageProperty(image,"comment");   if (comment != (const char *) NULL)     tga_info.id_length=(unsigned char) MagickMin(strlen(comment),255);   tga_info.colormap_type=0;   tga_info.colormap_index=0;   tga_info.colormap_length=0; static MagickBooleanType WriteTGAImage(const ImageInfo *image_info,Image *image)   (void) WriteBlobByte(image,tga_info.bits_per_pixel);   (void) WriteBlobByte(image,tga_info.attributes);   if (tga_info.id_length != 0)     (void) WriteBlob(image,tga_info.id_length,(unsigned char *) comment);   if (tga_info.colormap_type != 0)     {       unsigned char

Patch:
patch: @@ -710,6 +710,7 @@ static MagickBooleanType WriteTGAImage(const ImageInfo *image_info,Image *image)
     compression;
 
   const char
+    *comment,
     *value;
 
   const double
@@ -766,9 +767,9 @@ static MagickBooleanType WriteTGAImage(const ImageInfo *image_info,Image *image)
     compression=image_info->compression;
   range=GetQuantumRange(5UL);
   tga_info.id_length=0;
-  value=GetImageProperty(image,"comment");
-  if (value != (const char *) NULL)
-    tga_info.id_length=(unsigned char) MagickMin(strlen(value),255);
+  comment=GetImageProperty(image,"comment");
+  if (comment != (const char *) NULL)
+    tga_info.id_length=(unsigned char) MagickMin(strlen(comment),255);
   tga_info.colormap_type=0;
   tga_info.colormap_index=0;
   tga_info.colormap_length=0;
@@ -852,7 +853,7 @@ static MagickBooleanType WriteTGAImage(const ImageInfo *image_info,Image *image)
   (void) WriteBlobByte(image,tga_info.bits_per_pixel);
   (void) WriteBlobByte(image,tga_info.attributes);
   if (tga_info.id_length != 0)
-    (void) WriteBlob(image,tga_info.id_length,(unsigned char *) value);
+    (void) WriteBlob(image,tga_info.id_length,(unsigned char *) comment);
   if (tga_info.colormap_type != 0)
     {
       unsigned char
path: coders/tga.c