Vulnerability: Memory leak in AcquireVirtualMemory in ImageMagick before 7 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors.
Vulnerability ID: CVE-2016-7539
CWE: CWE-399
Severity score: 6.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-07-25
File: magick/cache.c
Commit message: http://www.imagemagick.org/discourse-server/viewtopic.php?f=2&t=28946
Commit author: Cristy

Vulnerable version (before fix):
 static MagickBooleanType MaskPixelCacheNexus(Image *image,NexusInfo *nexus_info, % */  static inline void AllocatePixelCachePixels(CacheInfo *cache_info) {   cache_info->mapped=MagickFalse;   cache_info->pixels=(PixelPacket *) MagickAssumeAligned(     AcquireAlignedMemory(1,(size_t) cache_info->length));   if (cache_info->pixels == (PixelPacket *) NULL)     {       cache_info->mapped=MagickTrue;       cache_info->pixels=(PixelPacket *) MapBlob(-1,IOMode,0,(size_t)         cache_info->length);     } }  #if defined(__cplusplus) || defined(c_plusplus) extern "C" { #endif static MagickBooleanType OpenPixelCache(Image *image,const MapMode mode,       if (((cache_info->type == UndefinedCache) && (status != MagickFalse)) ||           (cache_info->type == MemoryCache))         {           AllocatePixelCachePixels(cache_info);           if (cache_info->pixels == (PixelPacket *) NULL)             cache_info->pixels=source_info.pixels;           else

Fixed version (after fix):
 static MagickBooleanType MaskPixelCacheNexus(Image *image,NexusInfo *nexus_info, % */  #if defined(__cplusplus) || defined(c_plusplus) extern "C" { #endif static MagickBooleanType OpenPixelCache(Image *image,const MapMode mode,       if (((cache_info->type == UndefinedCache) && (status != MagickFalse)) ||           (cache_info->type == MemoryCache))         {           cache_info->mapped=MagickFalse;           cache_info->pixels=(PixelPacket *) MagickAssumeAligned(             AcquireAlignedMemory(1,(size_t) cache_info->length));           if (cache_info->pixels == (PixelPacket *) NULL)             cache_info->pixels=source_info.pixels;           else

Patch:
patch: @@ -3371,19 +3371,6 @@ static MagickBooleanType MaskPixelCacheNexus(Image *image,NexusInfo *nexus_info,
 %
 */
 
-static inline void AllocatePixelCachePixels(CacheInfo *cache_info)
-{
-  cache_info->mapped=MagickFalse;
-  cache_info->pixels=(PixelPacket *) MagickAssumeAligned(
-    AcquireAlignedMemory(1,(size_t) cache_info->length));
-  if (cache_info->pixels == (PixelPacket *) NULL)
-    {
-      cache_info->mapped=MagickTrue;
-      cache_info->pixels=(PixelPacket *) MapBlob(-1,IOMode,0,(size_t)
-        cache_info->length);
-    }
-}
-
 #if defined(__cplusplus) || defined(c_plusplus)
 extern "C" {
 #endif
@@ -3603,7 +3590,9 @@ static MagickBooleanType OpenPixelCache(Image *image,const MapMode mode,
       if (((cache_info->type == UndefinedCache) && (status != MagickFalse)) ||
           (cache_info->type == MemoryCache))
         {
-          AllocatePixelCachePixels(cache_info);
+          cache_info->mapped=MagickFalse;
+          cache_info->pixels=(PixelPacket *) MagickAssumeAligned(
+            AcquireAlignedMemory(1,(size_t) cache_info->length));
           if (cache_info->pixels == (PixelPacket *) NULL)
             cache_info->pixels=source_info.pixels;
           else
path: magick/cache.c