Vulnerability: ImageMagick 7.0.8-50 Q16 has a heap-based buffer over-read in MagickCore/composite.c in CompositeImage.
Vulnerability ID: CVE-2019-13303
CWE: CWE-125
Severity score: 6.4
Project: https://github.com/ImageMagick/ImageMagick
Published: 2019-07-05
File: MagickCore/composite.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/1603
Commit author: Cristy

Vulnerable version (before fix):
 MagickExport MagickBooleanType CompositeImage(Image *image,               q+=GetPixelChannels(image);               continue;             }           for (i=0; i < (ssize_t) GetPixelChannels(image); i++)           {             PixelChannel channel = GetPixelChannelChannel(image,i);             PixelTrait traits = GetPixelChannelTraits(image,channel);             PixelTrait source_traits=GetPixelChannelTraits(source_image,               channel);             if (traits == UndefinedPixelTrait)               continue;             if (source_traits != UndefinedPixelTrait)               SetPixelChannel(image,channel,p[i],q);             else if (channel == AlphaPixelChannel)               SetPixelChannel(image,channel,OpaqueAlpha,q);           }           p+=GetPixelChannels(source_image);           q+=GetPixelChannels(image);

Fixed version (after fix):
 MagickExport MagickBooleanType CompositeImage(Image *image,               q+=GetPixelChannels(image);               continue;             }           for (i=0; i < (ssize_t) GetPixelChannels(source_image); i++)           {             PixelChannel channel = GetPixelChannelChannel(source_image,i);             PixelTrait source_traits = GetPixelChannelTraits(source_image,               channel);             PixelTrait traits = GetPixelChannelTraits(image,channel);             if (source_traits == UndefinedPixelTrait)               continue;             if (traits != UndefinedPixelTrait)               SetPixelChannel(image,channel,p[i],q);             else               if (channel == AlphaPixelChannel)                 SetPixelChannel(image,channel,OpaqueAlpha,q);           }           p+=GetPixelChannels(source_image);           q+=GetPixelChannels(image);

Patch:
patch: @@ -654,18 +654,19 @@ MagickExport MagickBooleanType CompositeImage(Image *image,
               q+=GetPixelChannels(image);
               continue;
             }
-          for (i=0; i < (ssize_t) GetPixelChannels(image); i++)
+          for (i=0; i < (ssize_t) GetPixelChannels(source_image); i++)
           {
-            PixelChannel channel = GetPixelChannelChannel(image,i);
-            PixelTrait traits = GetPixelChannelTraits(image,channel);
-            PixelTrait source_traits=GetPixelChannelTraits(source_image,
+            PixelChannel channel = GetPixelChannelChannel(source_image,i);
+            PixelTrait source_traits = GetPixelChannelTraits(source_image,
               channel);
-            if (traits == UndefinedPixelTrait)
+            PixelTrait traits = GetPixelChannelTraits(image,channel);
+            if (source_traits == UndefinedPixelTrait)
               continue;
-            if (source_traits != UndefinedPixelTrait)
+            if (traits != UndefinedPixelTrait)
               SetPixelChannel(image,channel,p[i],q);
-            else if (channel == AlphaPixelChannel)
-              SetPixelChannel(image,channel,OpaqueAlpha,q);
+            else
+              if (channel == AlphaPixelChannel)
+                SetPixelChannel(image,channel,OpaqueAlpha,q);
           }
           p+=GetPixelChannels(source_image);
           q+=GetPixelChannels(image);
path: MagickCore/composite.c