rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name.
Vulnerability ID: CVE-2016-7419
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/nextcloud/gallery
Published: 2016-09-17
File: js/vendor/owncloud/share.js
Commit message: Add more escaping

Escape folder names in share.js
Commit author: Olivier Paroz

Vulnerable version (before fix):
 			var data = this._loadShares(path); 			var dropDownEl; 			var self = this; 			var html = '<div id="dropdown" class="drop shareDropDown" data-item-type="' + itemType + 				'" data-item-source="' + path + '">'; 			if (data !== false && data[0] && !_.isUndefined(data[0].uid_file_owner) && 				data[0].uid_file_owner !== OC.currentUser 			) {

Fixed version (after fix):
 			var data = this._loadShares(path); 			var dropDownEl; 			var self = this; 			var html = '<div id="dropdown" class="drop shareDropDown" data-item-type="' + escapeHTML(itemType) + 				'" data-item-source="' + escapeHTML(path) + '">'; 			if (data !== false && data[0] && !_.isUndefined(data[0].uid_file_owner) && 				data[0].uid_file_owner !== OC.currentUser 			) {

Patch:
patch: @@ -144,8 +144,8 @@
 			var data = this._loadShares(path);
 			var dropDownEl;
 			var self = this;
-			var html = '<div id="dropdown" class="drop shareDropDown" data-item-type="' + itemType +
-				'" data-item-source="' + path + '">';
+			var html = '<div id="dropdown" class="drop shareDropDown" data-item-type="' + escapeHTML(itemType) +
+				'" data-item-source="' + escapeHTML(path) + '">';
 			if (data !== false && data[0] && !_.isUndefined(data[0].uid_file_owner) &&
 				data[0].uid_file_owner !== OC.currentUser
 			) {
path: js/vendor/owncloud/share.js
Vulnerability: The arcmsr_iop_message_xfer function in drivers/scsi/arcmsr/arcmsr_hba.c in the Linux kernel through 4.8.2 does not restrict a certain length field, which allows local users to gain privileges or cause a denial of service (heap-based buffer overflow) via an ARCMSR_MESSAGE_WRITE_WQBUFFER control code.
Vulnerability ID: CVE-2016-7425
CWE: CWE-119
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2016-10-16
File: drivers/scsi/arcmsr/arcmsr_hba.c
Commit message: scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer()

We need to put an upper bound on "user_len" so the memcpy() doesn't
overflow.

Cc: <stable@vger.kernel.org>
Reported-by: Marco Grassi <marco.gra@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Commit author: Dan Carpenter

Vulnerable version (before fix):
 static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, 	} 	case ARCMSR_MESSAGE_WRITE_WQBUFFER: { 		unsigned char *ver_addr; 		int32_t user_len, cnt2end; 		uint8_t *pQbuffer, *ptmpuserbuffer; 		ver_addr = kmalloc(ARCMSR_API_DATA_BUFLEN, GFP_ATOMIC); 		if (!ver_addr) { static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, 		} 		ptmpuserbuffer = ver_addr; 		user_len = pcmdmessagefld->cmdmessage.Length; 		memcpy(ptmpuserbuffer, 			pcmdmessagefld->messagedatabuffer, user_len); 		spin_lock_irqsave(&acb->wqbuffer_lock, flags);

Fixed version (after fix):
 static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, 	} 	case ARCMSR_MESSAGE_WRITE_WQBUFFER: { 		unsigned char *ver_addr; 		uint32_t user_len; 		int32_t cnt2end; 		uint8_t *pQbuffer, *ptmpuserbuffer; 		ver_addr = kmalloc(ARCMSR_API_DATA_BUFLEN, GFP_ATOMIC); 		if (!ver_addr) { static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb, 		} 		ptmpuserbuffer = ver_addr; 		user_len = pcmdmessagefld->cmdmessage.Length; 		if (user_len > ARCMSR_API_DATA_BUFLEN) { 			retvalue = ARCMSR_MESSAGE_FAIL; 			kfree(ver_addr); 			goto message_out; 		} 		memcpy(ptmpuserbuffer, 			pcmdmessagefld->messagedatabuffer, user_len); 		spin_lock_irqsave(&acb->wqbuffer_lock, flags);

Patch:
patch: @@ -2388,7 +2388,8 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb,
 	}
 	case ARCMSR_MESSAGE_WRITE_WQBUFFER: {
 		unsigned char *ver_addr;
-		int32_t user_len, cnt2end;
+		uint32_t user_len;
+		int32_t cnt2end;
 		uint8_t *pQbuffer, *ptmpuserbuffer;
 		ver_addr = kmalloc(ARCMSR_API_DATA_BUFLEN, GFP_ATOMIC);
 		if (!ver_addr) {
@@ -2397,6 +2398,11 @@ static int arcmsr_iop_message_xfer(struct AdapterControlBlock *acb,
 		}
 		ptmpuserbuffer = ver_addr;
 		user_len = pcmdmessagefld->cmdmessage.Length;
+		if (user_len > ARCMSR_API_DATA_BUFLEN) {
+			retvalue = ARCMSR_MESSAGE_FAIL;
+			kfree(ver_addr);
+			goto message_out;
+		}
 		memcpy(ptmpuserbuffer,
 			pcmdmessagefld->messagedatabuffer, user_len);
 		spin_lock_irqsave(&acb->wqbuffer_lock, flags);
path: drivers/scsi/arcmsr/arcmsr_hba.c
Vulnerability: The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to upload a malicious file to any folder on the site via a cpi directory traversal.
Vulnerability ID: CVE-2016-7452
CWE: CWE-434
Severity score: 2.9
Project: https://github.com/exponentcms/exponent-cms
Published: 2016-11-03
File: framework/modules/pixidou/controllers/pixidouController.php
Commit message: security fix to pixidou editor
Commit author: dleffler

Vulnerable version (before fix):
 function editor() {     }          public function exitEditor() {          //eDebug($this->params,true);         switch ($this->params['exitType']) {             case 'saveAsCopy':                 $oldimage = new expFile($this->params['fid']);                

Fixed version (after fix):
 function editor() {     }          public function exitEditor() {         // clean up parameters         $this->params['fid'] = intval($this->params['fid']);         if (!empty($this->params['cpi']) && strpos($this->params['cpi'], '..') !== false) {             $this->params['exitType'] = 'error';         }         switch ($this->params['exitType']) {             case 'saveAsCopy':                 $oldimage = new expFile($this->params['fid']);                

Patch:
patch: @@ -58,8 +58,11 @@ function editor() {
     }
     
     public function exitEditor() {
-
-        //eDebug($this->params,true);
+        // clean up parameters
+        $this->params['fid'] = intval($this->params['fid']);
+        if (!empty($this->params['cpi']) && strpos($this->params['cpi'], '..') !== false) {
+            $this->params['exitType'] = 'error';
+        }
         switch ($this->params['exitType']) {
             case 'saveAsCopy':
                 $oldimage = new expFile($this->params['fid']);
path: framework/modules/pixidou/controllers/pixidouController.php
Vulnerability: The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access) via crafted serialized data.
Vulnerability ID: CVE-2016-7480
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/php/php-src
Published: 2017-01-11
File: ext/spl/spl_observer.c
Commit message: Fix bug #73257 and bug #73258 - SplObjectStorage unserialize allows use of non-object as key
Commit author: Stanislav Malyshev

Vulnerable version (before fix):
 SPL_METHOD(SplObjectStorage, unserialize) 	--p; /* for ';' */ 	count = Z_LVAL_P(pcount);  	while (count-- > 0) { 		spl_SplObjectStorageElement *pelement; 		zend_string *hash; SPL_METHOD(SplObjectStorage, unserialize) 		if (!php_var_unserialize(&entry, &p, s + buf_len, &var_hash)) { 			goto outexcept; 		} 		if (Z_TYPE(entry) != IS_OBJECT) { 			zval_ptr_dtor(&entry); 			goto outexcept; 		} 		if (*p == ',') { /* new version has inf */ 			++p; 			if (!php_var_unserialize(&inf, &p, s + buf_len, &var_hash)) { 				zval_ptr_dtor(&entry); 				goto outexcept; 			} 		} else { 			ZVAL_UNDEF(&inf); 		}  		hash = spl_object_storage_get_hash(intern, getThis(), &entry);

Fixed version (after fix):
 SPL_METHOD(SplObjectStorage, unserialize) 	--p; /* for ';' */ 	count = Z_LVAL_P(pcount);  	ZVAL_UNDEF(&entry); 	ZVAL_UNDEF(&inf);  	while (count-- > 0) { 		spl_SplObjectStorageElement *pelement; 		zend_string *hash; SPL_METHOD(SplObjectStorage, unserialize) 		if (!php_var_unserialize(&entry, &p, s + buf_len, &var_hash)) { 			goto outexcept; 		} 		if (*p == ',') { /* new version has inf */ 			++p; 			if (!php_var_unserialize(&inf, &p, s + buf_len, &var_hash)) { 				zval_ptr_dtor(&entry); 				goto outexcept; 			} 		} 		if (Z_TYPE(entry) != IS_OBJECT) { 			zval_ptr_dtor(&entry); 			zval_ptr_dtor(&inf); 			goto outexcept; 		}  		hash = spl_object_storage_get_hash(intern, getThis(), &entry);

Patch:
patch: @@ -772,6 +772,9 @@ SPL_METHOD(SplObjectStorage, unserialize)
 	--p; /* for ';' */
 	count = Z_LVAL_P(pcount);
 
+	ZVAL_UNDEF(&entry);
+	ZVAL_UNDEF(&inf);
+
 	while (count-- > 0) {
 		spl_SplObjectStorageElement *pelement;
 		zend_string *hash;
@@ -787,18 +790,17 @@ SPL_METHOD(SplObjectStorage, unserialize)
 		if (!php_var_unserialize(&entry, &p, s + buf_len, &var_hash)) {
 			goto outexcept;
 		}
-		if (Z_TYPE(entry) != IS_OBJECT) {
-			zval_ptr_dtor(&entry);
-			goto outexcept;
-		}
 		if (*p == ',') { /* new version has inf */
 			++p;
 			if (!php_var_unserialize(&inf, &p, s + buf_len, &var_hash)) {
 				zval_ptr_dtor(&entry);
 				goto outexcept;
 			}
-		} else {
-			ZVAL_UNDEF(&inf);
+		}
+		if (Z_TYPE(entry) != IS_OBJECT) {
+			zval_ptr_dtor(&entry);
+			zval_ptr_dtor(&inf);
+			goto outexcept;
 		}
 
 		hash = spl_object_storage_get_hash(intern, getThis(), &entry);
path: ext/spl/spl_observer.c
Vulnerability: Heap-based buffer overflow in coders/hdr.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted HDR file.
Vulnerability ID: CVE-2016-7520
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-04-20
File: coders/hdr.c
Commit message: https://bugs.launchpad.net/ubuntu/+source/imagemagick/+bug/1537213
Commit author: Cristy

Vulnerable version (before fix):
 static MagickBooleanType WriteHDRImage(const ImageInfo *image_info,Image *image,     }   if (image->gamma != 0.0)     {       count=FormatLocaleString(header,MagickPathExtent,"GAMMA=%g\n",image->gamma);       (void) WriteBlob(image,(size_t) count,(unsigned char *) header);     }   count=FormatLocaleString(header,MagickPathExtent, static MagickBooleanType WriteHDRImage(const ImageInfo *image_info,Image *image,   /*     Write HDR pixels.   */   pixels=(unsigned char *) AcquireQuantumMemory(image->columns,4*     sizeof(*pixels));   if (pixels == (unsigned char *) NULL)     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");   for (y=0; y < (ssize_t) image->rows; y++)   {     p=GetVirtualPixels(image,0,y,image->columns,1,exception);

Fixed version (after fix):
 static MagickBooleanType WriteHDRImage(const ImageInfo *image_info,Image *image,     }   if (image->gamma != 0.0)     {       count=FormatLocaleString(header,MagickPathExtent,"GAMMA=%g\n",         image->gamma);       (void) WriteBlob(image,(size_t) count,(unsigned char *) header);     }   count=FormatLocaleString(header,MagickPathExtent, static MagickBooleanType WriteHDRImage(const ImageInfo *image_info,Image *image,   /*     Write HDR pixels.   */   pixels=(unsigned char *) AcquireQuantumMemory(image->columns+128,4*     sizeof(*pixels));   if (pixels == (unsigned char *) NULL)     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");   (void) ResetMagickMemory(pixels,0,4*(image->columns+128)*sizeof(*pixels));   for (y=0; y < (ssize_t) image->rows; y++)   {     p=GetVirtualPixels(image,0,y,image->columns,1,exception);

Patch:
patch: @@ -723,7 +723,8 @@ static MagickBooleanType WriteHDRImage(const ImageInfo *image_info,Image *image,
     }
   if (image->gamma != 0.0)
     {
-      count=FormatLocaleString(header,MagickPathExtent,"GAMMA=%g\n",image->gamma);
+      count=FormatLocaleString(header,MagickPathExtent,"GAMMA=%g\n",
+        image->gamma);
       (void) WriteBlob(image,(size_t) count,(unsigned char *) header);
     }
   count=FormatLocaleString(header,MagickPathExtent,
@@ -741,10 +742,11 @@ static MagickBooleanType WriteHDRImage(const ImageInfo *image_info,Image *image,
   /*
     Write HDR pixels.
   */
-  pixels=(unsigned char *) AcquireQuantumMemory(image->columns,4*
+  pixels=(unsigned char *) AcquireQuantumMemory(image->columns+128,4*
     sizeof(*pixels));
   if (pixels == (unsigned char *) NULL)
     ThrowWriterException(ResourceLimitError,"MemoryAllocationFailed");
+  (void) ResetMagickMemory(pixels,0,4*(image->columns+128)*sizeof(*pixels));
   for (y=0; y < (ssize_t) image->rows; y++)
   {
     p=GetVirtualPixels(image,0,y,image->columns,1,exception);
path: coders/hdr.c
Vulnerability: Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
Vulnerability ID: CVE-2016-7521
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-04-20
File: coders/psd.c
Commit message: Moved check for https://github.com/ImageMagick/ImageMagick/issues/92.
Commit author: dirk

Vulnerable version (before fix):
 static ssize_t DecodePSDPixels(const size_t number_compact_pixels,     length++;     for (j=0; j < (ssize_t) length; j++)     {       switch (depth)       {         case 1: static ssize_t DecodePSDPixels(const size_t number_compact_pixels,           break;         }       }       CheckNumberCompactPixels;       compact_pixels++;     }   }

Fixed version (after fix):
 static ssize_t DecodePSDPixels(const size_t number_compact_pixels,     length++;     for (j=0; j < (ssize_t) length; j++)     {       CheckNumberCompactPixels;       switch (depth)       {         case 1: static ssize_t DecodePSDPixels(const size_t number_compact_pixels,           break;         }       }       compact_pixels++;     }   }

Patch:
patch: @@ -487,6 +487,7 @@ static ssize_t DecodePSDPixels(const size_t number_compact_pixels,
     length++;
     for (j=0; j < (ssize_t) length; j++)
     {
+      CheckNumberCompactPixels;
       switch (depth)
       {
         case 1:
@@ -525,7 +526,6 @@ static ssize_t DecodePSDPixels(const size_t number_compact_pixels,
           break;
         }
       }
-      CheckNumberCompactPixels;
       compact_pixels++;
     }
   }
path: coders/psd.c
Vulnerability: The ReadPSDImage function in MagickCore/locale.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
Vulnerability ID: CVE-2016-7522
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-04-19
File: coders/psd.c
Commit message: Added extra check to fix https://github.com/ImageMagick/ImageMagick/issues/93
Commit author: dirk

Vulnerable version (before fix):
 static Image *ReadPSDImage(const ImageInfo *image_info,ExceptionInfo *exception)       if (blocks == (unsigned char *) NULL)         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");       count=ReadBlob(image,(size_t) length,blocks);       if ((count != (ssize_t) length) ||           (LocaleNCompare((char *) blocks,"8BIM",4) != 0))         {           blocks=(unsigned char *) RelinquishMagickMemory(blocks);

Fixed version (after fix):
 static Image *ReadPSDImage(const ImageInfo *image_info,ExceptionInfo *exception)       if (blocks == (unsigned char *) NULL)         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");       count=ReadBlob(image,(size_t) length,blocks);       if ((count != (ssize_t) length) || (length < 4) ||           (LocaleNCompare((char *) blocks,"8BIM",4) != 0))         {           blocks=(unsigned char *) RelinquishMagickMemory(blocks);

Patch:
patch: @@ -1936,7 +1936,7 @@ static Image *ReadPSDImage(const ImageInfo *image_info,ExceptionInfo *exception)
       if (blocks == (unsigned char *) NULL)
         ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
       count=ReadBlob(image,(size_t) length,blocks);
-      if ((count != (ssize_t) length) ||
+      if ((count != (ssize_t) length) || (length < 4) ||
           (LocaleNCompare((char *) blocks,"8BIM",4) != 0))
         {
           blocks=(unsigned char *) RelinquishMagickMemory(blocks);
path: coders/psd.c
Vulnerability: Heap-based buffer overflow in coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted PSD file.
Vulnerability ID: CVE-2016-7525
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-04-20
File: coders/psd.c
Commit message: Fixed head buffer overflow reported in: https://github.com/ImageMagick/ImageMagick/issues/98
Commit author: dirk

Vulnerable version (before fix):
 static inline MagickSizeType GetPSDSize(const PSDInfo *psd_info,Image *image) static inline size_t GetPSDRowSize(Image *image) {   if (image->depth == 1)     return((image->columns+7)/8);   else     return(image->columns*GetPSDPacketSize(image)); }

Fixed version (after fix):
 static inline MagickSizeType GetPSDSize(const PSDInfo *psd_info,Image *image) static inline size_t GetPSDRowSize(Image *image) {   if (image->depth == 1)     return(((image->columns+7)/8)*GetPSDPacketSize(image));   else     return(image->columns*GetPSDPacketSize(image)); }

Patch:
patch: @@ -575,7 +575,7 @@ static inline MagickSizeType GetPSDSize(const PSDInfo *psd_info,Image *image)
 static inline size_t GetPSDRowSize(Image *image)
 {
   if (image->depth == 1)
-    return((image->columns+7)/8);
+    return(((image->columns+7)/8)*GetPSDPacketSize(image));
   else
     return(image->columns*GetPSDPacketSize(image));
 }
path: coders/psd.c
Vulnerability: coders/xcf.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted XCF file.
Vulnerability ID: CVE-2016-7529
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-04-19
File: coders/xcf.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/104
Commit author: Cristy

Vulnerable version (before fix):
 static MagickBooleanType load_tile(Image *image,Image *tile_image,     *xcfdata,     *xcfodata;    xcfdata=(XCFPixelInfo *) AcquireQuantumMemory(data_length,sizeof(*xcfdata));   if (xcfdata == (XCFPixelInfo *) NULL)     ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",       image->filename);

Fixed version (after fix):
 static MagickBooleanType load_tile(Image *image,Image *tile_image,     *xcfdata,     *xcfodata;    xcfdata=(XCFPixelInfo *) AcquireQuantumMemory(MagickMax(data_length,     tile_image->columns*tile_image->rows),sizeof(*xcfdata));   if (xcfdata == (XCFPixelInfo *) NULL)     ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",       image->filename);

Patch:
patch: @@ -347,7 +347,8 @@ static MagickBooleanType load_tile(Image *image,Image *tile_image,
     *xcfdata,
     *xcfodata;
 
-  xcfdata=(XCFPixelInfo *) AcquireQuantumMemory(data_length,sizeof(*xcfdata));
+  xcfdata=(XCFPixelInfo *) AcquireQuantumMemory(MagickMax(data_length,
+    tile_image->columns*tile_image->rows),sizeof(*xcfdata));
   if (xcfdata == (XCFPixelInfo *) NULL)
     ThrowBinaryException(ResourceLimitError,"MemoryAllocationFailed",
       image->filename);
path: coders/xcf.c
Vulnerability: The ReadWPGImage function in coders/wpg.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WPG file.
Vulnerability ID: CVE-2016-7533
CWE: CWE-125
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-04-19
File: coders/wpg.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/120
Commit author: Cristy

Vulnerable version (before fix):
 static Image *ReadWPGImage(const ImageInfo *image_info,                   {                     ldblk=(ssize_t) ((bpp*image->columns+7)/8);                     BImgBuff=(unsigned char *) AcquireQuantumMemory((size_t)                       ldblk,sizeof(*BImgBuff));                     if (BImgBuff == (unsigned char *) NULL)                       goto NoMemory; 

Fixed version (after fix):
 static Image *ReadWPGImage(const ImageInfo *image_info,                   {                     ldblk=(ssize_t) ((bpp*image->columns+7)/8);                     BImgBuff=(unsigned char *) AcquireQuantumMemory((size_t)                       ldblk+1,sizeof(*BImgBuff));                     if (BImgBuff == (unsigned char *) NULL)                       goto NoMemory; 

Patch:
patch: @@ -1331,7 +1331,7 @@ static Image *ReadWPGImage(const ImageInfo *image_info,
                   {
                     ldblk=(ssize_t) ((bpp*image->columns+7)/8);
                     BImgBuff=(unsigned char *) AcquireQuantumMemory((size_t)
-                      ldblk,sizeof(*BImgBuff));
+                      ldblk+1,sizeof(*BImgBuff));
                     if (BImgBuff == (unsigned char *) NULL)
                       goto NoMemory;
path: coders/wpg.c
Vulnerability: coders/psd.c in ImageMagick allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted file.
Vulnerability ID: CVE-2016-7538
CWE: CWE-787
Severity score: 2.9
Project: https://github.com/ImageMagick/ImageMagick
Published: 2017-04-20
File: coders/psd.c
Commit message: https://github.com/ImageMagick/ImageMagick/issues/148
Commit author: Cristy

Vulnerable version (before fix):
 static void RemoveICCProfileFromResourceBlock(StringInfo *bim_profile)     p=PushLongPixel(MSBEndian,p,&count);     if (id == 0x0000040f)       {         (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-           (PSDQuantum(count)+12)-(q-datum));         SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));         break;       }     p+=count;

Fixed version (after fix):
 static void RemoveICCProfileFromResourceBlock(StringInfo *bim_profile)     p=PushLongPixel(MSBEndian,p,&count);     if (id == 0x0000040f)       {         if ((q+PSDQuantum(count)+12) < (datum+length-16))           {             (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-               (PSDQuantum(count)+12)-(q-datum));             SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));           }         break;       }     p+=count;

Patch:
patch: @@ -2566,9 +2566,12 @@ static void RemoveICCProfileFromResourceBlock(StringInfo *bim_profile)
     p=PushLongPixel(MSBEndian,p,&count);
     if (id == 0x0000040f)
       {
-        (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
-          (PSDQuantum(count)+12)-(q-datum));
-        SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));
+        if ((q+PSDQuantum(count)+12) < (datum+length-16))
+          {
+            (void) CopyMagickMemory(q,q+PSDQuantum(count)+12,length-
+              (PSDQuantum(count)+12)-(q-datum));
+            SetStringInfoLength(bim_profile,length-(PSDQuantum(count)+12));
+          }
         break;
       }
     p+=count;
path: coders/psd.c