CVE-2019-13300 (published 2019-07-05T01:15Z)

ImageMagick 7.0.8-50 Q16 has a heap-based buffer overflow at MagickCore/statistic.c in EvaluateImages because of mishandling columns.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2019-06-16 14:35:14-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1586
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: statistic.c
change_type: ModificationType.MODIFY
diff: @@ -150,8 +150,11 @@ static PixelChannels **DestroyPixelThreadSet(PixelChannels **pixels)
   return(pixels);
 }
 
-static PixelChannels **AcquirePixelThreadSet(const Image *image)
+static PixelChannels **AcquirePixelThreadSet(const Image *images)
 {
+  const Image
+    *next;
+
   PixelChannels
     **pixels;
 
@@ -159,6 +162,7 @@ static PixelChannels **AcquirePixelThreadSet(const Image *image)
     i;
 
   size_t
+    columns,
     number_threads;
 
   number_threads=(size_t) GetMagickResourceLimit(ThreadResource);
@@ -167,16 +171,18 @@ static PixelChannels **AcquirePixelThreadSet(const Image *image)
   if (pixels == (PixelChannels **) NULL)
     return((PixelChannels **) NULL);
   (void) memset(pixels,0,number_threads*sizeof(*pixels));
+  columns=images->columns;
+  for (next=images; next != (Image *) NULL; next=next->next)
+    columns=MagickMax(next->columns,columns);
   for (i=0; i < (ssize_t) number_threads; i++)
   {
     register ssize_t
       j;
 
-    pixels[i]=(PixelChannels *) AcquireQuantumMemory(image->columns,
-      sizeof(**pixels));
+    pixels[i]=(PixelChannels *) AcquireQuantumMemory(columns,sizeof(**pixels));
     if (pixels[i] == (PixelChannels *) NULL)
       return(DestroyPixelThreadSet(pixels));
-    for (j=0; j < (ssize_t) image->columns; j++)
+    for (j=0; j < (ssize_t) columns; j++)
     {
       register ssize_t
         k;

programming_language: Objective-C
repo_url: https://github.com/ImageMagick/ImageMagick6
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick6
author: Cristy
author_date: 2019-06-16 14:36:10-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1586
repository: repo_url: https://github.com/ImageMagick/ImageMagick6
repo_name: ImageMagick/ImageMagick6
description: 🧙‍♂️ ImageMagick 6
repo_language: C
owner: ImageMagick
file_changes: filename: statistic.c
change_type: ModificationType.MODIFY
diff: @@ -149,8 +149,11 @@ static MagickPixelPacket **DestroyPixelThreadSet(MagickPixelPacket **pixels)
   return(pixels);
 }
 
-static MagickPixelPacket **AcquirePixelThreadSet(const Image *image)
+static MagickPixelPacket **AcquirePixelThreadSet(const Image *images)
 {
+  const Image
+    *next;
+
   MagickPixelPacket
     **pixels;
 
@@ -159,6 +162,7 @@ static MagickPixelPacket **AcquirePixelThreadSet(const Image *image)
     j;
 
   size_t
+    columns,
     number_threads;
 
   number_threads=(size_t) GetMagickResourceLimit(ThreadResource);
@@ -167,14 +171,17 @@ static MagickPixelPacket **AcquirePixelThreadSet(const Image *image)
   if (pixels == (MagickPixelPacket **) NULL)
     return((MagickPixelPacket **) NULL);
   (void) memset(pixels,0,number_threads*sizeof(*pixels));
+  columns=images->columns;
+  for (next=images; next != (Image *) NULL; next=next->next)
+    columns=MagickMax(next->columns,columns);
   for (i=0; i < (ssize_t) number_threads; i++)
   {
-    pixels[i]=(MagickPixelPacket *) AcquireQuantumMemory(image->columns,
+    pixels[i]=(MagickPixelPacket *) AcquireQuantumMemory(columns,
       sizeof(**pixels));
     if (pixels[i] == (MagickPixelPacket *) NULL)
       return(DestroyPixelThreadSet(pixels));
-    for (j=0; j < (ssize_t) image->columns; j++)
-      GetMagickPixelPacket(image,&pixels[i][j]);
+    for (j=0; j < (ssize_t) columns; j++)
+      GetMagickPixelPacket(images,&pixels[i][j]);
   }
   return(pixels);
 }

programming_language: C