CVE-2015-8958 (published 2017-04-20T18:59Z)

coders/sun.c in ImageMagick before 6.9.0-4 Beta allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted SUN file.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: cristy
author_date: 2015-01-10 14:10:16+00:00
msg: http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=26857
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: sun.c
change_type: ModificationType.MODIFY
diff: @@ -409,8 +409,8 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
         sun_info.length || !sun_info.length)
       ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     number_pixels=(MagickSizeType) image->columns*image->rows;
-    if ((sun_info.type != RT_ENCODED) && (sun_info.depth >= 8) &&
-        ((number_pixels*((sun_info.depth+7)/8)) > sun_info.length))
+    if ((sun_info.type != RT_ENCODED) && 
+        ((number_pixels*sun_info.depth) > (8*sun_info.length)))
       ThrowReaderException(CorruptImageError,"ImproperImageHeader");
     bytes_per_line=sun_info.width*sun_info.depth;
     sun_data=(unsigned char *) AcquireQuantumMemory((size_t) MagickMax(
@@ -532,7 +532,7 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
             bytes_per_pixel++;
           if (bytes_per_line == 0)
             bytes_per_line=bytes_per_pixel*image->columns;
-          length=image->rows*(bytes_per_line+image->columns % 2);
+          length=image->rows*(bytes_per_line+bytes_per_line % 2);
           if (((sun_info.type == RT_ENCODED) &&
                (length > (bytes_per_line*image->rows))) ||
               ((sun_info.type != RT_ENCODED) && (length > sun_info.length)))

programming_language: Objective-C
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: cristy
author_date: 2015-01-13 13:31:27+00:00
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: sun.c
change_type: ModificationType.MODIFY
diff: @@ -255,8 +255,7 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
   size_t
     bytes_per_line,
     extent,
-    height,
-    length;
+    height;
 
   ssize_t
     count,
@@ -489,13 +488,6 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
     else
       if (image->storage_class == PseudoClass)
         {
-          if (bytes_per_line == 0)
-            bytes_per_line=image->columns;
-          length=image->rows*(image->columns+image->columns % 2);
-          if (((sun_info.type == RT_ENCODED) &&
-               (length > (bytes_per_line*image->rows))) ||
-              ((sun_info.type != RT_ENCODED) && (length > sun_info.length)))
-            ThrowReaderException(CorruptImageError,"UnableToReadImageData");
           for (y=0; y < (ssize_t) image->rows; y++)
           {
             q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);
@@ -529,11 +521,6 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
             bytes_per_pixel++;
           if (bytes_per_line == 0)
             bytes_per_line=bytes_per_pixel*image->columns;
-          length=image->rows*(bytes_per_line+bytes_per_line % 2);
-          if (((sun_info.type == RT_ENCODED) &&
-               (length > (bytes_per_line*image->rows))) ||
-              ((sun_info.type != RT_ENCODED) && (length > sun_info.length)))
-            ThrowReaderException(CorruptImageError,"UnableToReadImageData");
           for (y=0; y < (ssize_t) image->rows; y++)
           {
             q=QueueAuthenticPixels(image,0,y,image->columns,1,exception);

programming_language: Objective-C
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: cristy
author_date: 2015-01-13 12:16:28+00:00
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: sun.c
change_type: ModificationType.MODIFY
diff: @@ -408,7 +408,7 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
       return(DestroyImageList(image));
     if ((sun_info.length*sizeof(*sun_data))/sizeof(*sun_data) !=
         sun_info.length || !sun_info.length)
-      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+      ThrowReaderException(ResourceLimitError,"ImproperImageHeader");
     number_pixels=(MagickSizeType) image->columns*image->rows;
     if ((sun_info.type != RT_ENCODED) && 
         ((number_pixels*sun_info.depth) > (8*sun_info.length)))
@@ -424,11 +424,11 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
     height=sun_info.height;
     if ((height == 0) || (sun_info.width == 0) || (sun_info.depth == 0) ||
         ((bytes_per_line/sun_info.depth) != sun_info.width))
-      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+      ThrowReaderException(ResourceLimitError,"ImproperImageHeader");
     bytes_per_line+=15;
     bytes_per_line<<=1;
     if ((bytes_per_line >> 1) != (sun_info.width*sun_info.depth+15))
-      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+      ThrowReaderException(ResourceLimitError,"ImproperImageHeader");
     bytes_per_line>>=4;
     sun_pixels=(unsigned char *) AcquireQuantumMemory(height,
       bytes_per_line*sizeof(*sun_pixels));
@@ -437,6 +437,12 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
     if (sun_info.type == RT_ENCODED)
       (void) DecodeImage(sun_data,sun_info.length,sun_pixels,bytes_per_line*
         height);
+    else
+      {
+        if (sun_info.length > (height*bytes_per_line))
+          ThrowReaderException(ResourceLimitError,"ImproperImageHeader");
+        (void) CopyMagickMemory(sun_pixels,sun_data,sun_info.length);
+      }
     sun_data=(unsigned char *) RelinquishMagickMemory(sun_data);
     /*
       Convert SUN raster image to pixel packets.

programming_language: Objective-C
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: cristy
author_date: 2015-01-13 02:23:43+00:00
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: sun.c
change_type: ModificationType.MODIFY
diff: @@ -255,6 +255,7 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
   size_t
     bytes_per_line,
     extent,
+    height,
     length;
 
   ssize_t
@@ -420,33 +421,23 @@ static Image *ReadSUNImage(const ImageInfo *image_info,ExceptionInfo *exception)
     count=(ssize_t) ReadBlob(image,sun_info.length,sun_data);
     if (count != (ssize_t) sun_info.length)
       ThrowReaderException(CorruptImageError,"UnableToReadImageData");
-    sun_pixels=sun_data;
-    bytes_per_line=0;
+    height=sun_info.height;
+    if ((height == 0) || (sun_info.width == 0) || (sun_info.depth == 0) ||
+        ((bytes_per_line/sun_info.depth) != sun_info.width))
+      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+    bytes_per_line+=15;
+    bytes_per_line<<=1;
+    if ((bytes_per_line >> 1) != (sun_info.width*sun_info.depth+15))
+      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
+    bytes_per_line>>=4;
+    sun_pixels=(unsigned char *) AcquireQuantumMemory(height,
+      bytes_per_line*sizeof(*sun_pixels));
+    if (sun_pixels == (unsigned char *) NULL)
+      ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
     if (sun_info.type == RT_ENCODED)
-      {
-        size_t
-          height;
-
-        /*
-          Read run-length encoded raster pixels.
-        */
-        height=sun_info.height;
-        if ((height == 0) || (sun_info.width == 0) || (sun_info.depth == 0) ||
-            ((bytes_per_line/sun_info.depth) != sun_info.width))
-          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
-        bytes_per_line+=15;
-        bytes_per_line<<=1;
-        if ((bytes_per_line >> 1) != (sun_info.width*sun_info.depth+15))
-          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
-        bytes_per_line>>=4;
-        sun_pixels=(unsigned char *) AcquireQuantumMemory(height,
-          bytes_per_line*sizeof(*sun_pixels));
-        if (sun_pixels == (unsigned char *) NULL)
-          ThrowReaderException(ResourceLimitError,"MemoryAllocationFailed");
-        (void) DecodeImage(sun_data,sun_info.length,sun_pixels,bytes_per_line*
-          height);
-        sun_data=(unsigned char *) RelinquishMagickMemory(sun_data);
-      }
+      (void) DecodeImage(sun_data,sun_info.length,sun_pixels,bytes_per_line*
+        height);
+    sun_data=(unsigned char *) RelinquishMagickMemory(sun_data);
     /*
       Convert SUN raster image to pixel packets.
     */

programming_language: Objective-C