Vulnerability: Heap-based buffer overflow in enhance.c in ImageMagick before 7.0.6-6 allows remote attackers to cause a denial of service via a crafted file.
Vulnerability ID: CVE-2017-12876
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-08-28
File: MagickCore/enhance.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/663
https://github.com/ImageMagick/ImageMagick/issues/655
Commit author: Cristy

Vulnerable version (before fix):
 #include "MagickCore/artifact.h" #include "MagickCore/attribute.h" #include "MagickCore/cache.h" #include "MagickCore/cache-view.h" #include "MagickCore/channel.h" #include "MagickCore/color.h" MagickExport MagickBooleanType ContrastStretchImage(Image *image,   assert(image->signature == MagickCoreSignature);   if (image->debug != MagickFalse)     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);   if (SetImageGray(image,exception) != MagickFalse)     (void) SetImageColorspace(image,GRAYColorspace,exception);   black=(double *) AcquireQuantumMemory(GetPixelChannels(image),sizeof(*black)); MagickExport MagickBooleanType EqualizeImage(Image *image,   */   assert(image != (Image *) NULL);   assert(image->signature == MagickCoreSignature); #if defined(MAGICKCORE_OPENCL_SUPPORT)   if (AccelerateEqualizeImage(image,exception) != MagickFalse)     return(MagickTrue);

Fixed version (after fix):
 #include "MagickCore/artifact.h" #include "MagickCore/attribute.h" #include "MagickCore/cache.h" #include "MagickCore/cache-private.h" #include "MagickCore/cache-view.h" #include "MagickCore/channel.h" #include "MagickCore/color.h" MagickExport MagickBooleanType ContrastStretchImage(Image *image,   assert(image->signature == MagickCoreSignature);   if (image->debug != MagickFalse)     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);   if (SyncImagePixelCache(image,exception) == MagickFalse)     return(MagickFalse);   if (SetImageGray(image,exception) != MagickFalse)     (void) SetImageColorspace(image,GRAYColorspace,exception);   black=(double *) AcquireQuantumMemory(GetPixelChannels(image),sizeof(*black)); MagickExport MagickBooleanType EqualizeImage(Image *image,   */   assert(image != (Image *) NULL);   assert(image->signature == MagickCoreSignature);   if (SyncImagePixelCache(image,exception) == MagickFalse)     return(MagickFalse); #if defined(MAGICKCORE_OPENCL_SUPPORT)   if (AccelerateEqualizeImage(image,exception) != MagickFalse)     return(MagickTrue);

Patch:
patch: @@ -45,6 +45,7 @@
 #include "MagickCore/artifact.h"
 #include "MagickCore/attribute.h"
 #include "MagickCore/cache.h"
+#include "MagickCore/cache-private.h"
 #include "MagickCore/cache-view.h"
 #include "MagickCore/channel.h"
 #include "MagickCore/color.h"
@@ -1047,6 +1048,8 @@ MagickExport MagickBooleanType ContrastStretchImage(Image *image,
   assert(image->signature == MagickCoreSignature);
   if (image->debug != MagickFalse)
     (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",image->filename);
+  if (SyncImagePixelCache(image,exception) == MagickFalse)
+    return(MagickFalse);
   if (SetImageGray(image,exception) != MagickFalse)
     (void) SetImageColorspace(image,GRAYColorspace,exception);
   black=(double *) AcquireQuantumMemory(GetPixelChannels(image),sizeof(*black));
@@ -1530,6 +1533,8 @@ MagickExport MagickBooleanType EqualizeImage(Image *image,
   */
   assert(image != (Image *) NULL);
   assert(image->signature == MagickCoreSignature);
+  if (SyncImagePixelCache(image,exception) == MagickFalse)
+    return(MagickFalse);
 #if defined(MAGICKCORE_OPENCL_SUPPORT)
   if (AccelerateEqualizeImage(image,exception) != MagickFalse)
     return(MagickTrue);
path: MagickCore/enhance.c