CVE-2019-13391 (published 2019-07-07T22:15Z)

In ImageMagick 7.0.8-50 Q16, ComplexImages in MagickCore/fourier.c has a heap-based buffer over-read because of incorrect calls to GetCacheViewVirtualPixels.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick6
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick6
author: Cristy
author_date: 2019-06-16 12:18:36-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1588
repository: repo_url: https://github.com/ImageMagick/ImageMagick6
repo_name: ImageMagick/ImageMagick6
description: 🧙‍♂️ ImageMagick 6
repo_language: C
owner: ImageMagick
file_changes: filename: annotate.c
change_type: ModificationType.MODIFY
diff: @@ -266,6 +266,7 @@ MagickExport MagickBooleanType AnnotateImage(Image *image,
     {
       annotate_info=DestroyDrawInfo(annotate_info);
       annotate=DestroyDrawInfo(annotate);
+      text=DestroyString(text);
       return(MagickFalse);
     }
   p=text;
@@ -300,6 +301,7 @@ MagickExport MagickBooleanType AnnotateImage(Image *image,
       annotate_info=DestroyDrawInfo(annotate_info);
       annotate=DestroyDrawInfo(annotate);
       textlist=(char **) RelinquishMagickMemory(textlist);
+      text=DestroyString(text);
       return(MagickFalse);
     }
   if (IsGrayColorspace(image->colorspace) != MagickFalse)
@@ -517,6 +519,7 @@ MagickExport MagickBooleanType AnnotateImage(Image *image,
   annotate_info=DestroyDrawInfo(annotate_info);
   annotate=DestroyDrawInfo(annotate);
   textlist=(char **) RelinquishMagickMemory(textlist);
+  text=DestroyString(text);
   return(status);
 }
 

programming_language: Objective-C
filename: fourier.c
change_type: ModificationType.MODIFY
diff: @@ -245,10 +245,14 @@ MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,
 
     if (status == MagickFalse)
       continue;
-    Ar=GetCacheViewVirtualPixels(Ar_view,0,y,Ar_image->columns,1,exception);
-    Ai=GetCacheViewVirtualPixels(Ai_view,0,y,Ai_image->columns,1,exception);
-    Br=GetCacheViewVirtualPixels(Br_view,0,y,Br_image->columns,1,exception);
-    Bi=GetCacheViewVirtualPixels(Bi_view,0,y,Bi_image->columns,1,exception);
+    Ar=GetCacheViewVirtualPixels(Ar_view,0,y,
+      MagickMax(Ar_image->columns,Cr_image->columns),1,exception);
+    Ai=GetCacheViewVirtualPixels(Ai_view,0,y,
+      MagickMax(Ai_image->columns,Ci_image->columns),1,exception);
+    Br=GetCacheViewVirtualPixels(Br_view,0,y,
+      MagickMax(Br_image->columns,Cr_image->columns),1,exception);
+    Bi=GetCacheViewVirtualPixels(Bi_view,0,y,
+      MagickMax(Bi_image->columns,Ci_image->columns),1,exception);
     Cr=QueueCacheViewAuthenticPixels(Cr_view,0,y,Cr_image->columns,1,exception);
     Ci=QueueCacheViewAuthenticPixels(Ci_view,0,y,Ci_image->columns,1,exception);
     if ((Ar == (const PixelPacket *) NULL) ||

programming_language: Objective-C
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2019-06-16 12:18:01-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1588
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: annotate.c
change_type: ModificationType.MODIFY
diff: @@ -277,6 +277,7 @@ MagickExport MagickBooleanType AnnotateImage(Image *image,
     {
       annotate_info=DestroyDrawInfo(annotate_info);
       annotate=DestroyDrawInfo(annotate);
+      text=DestroyString(text);
       return(MagickFalse);
     }
   p=text;
@@ -311,6 +312,7 @@ MagickExport MagickBooleanType AnnotateImage(Image *image,
       annotate_info=DestroyDrawInfo(annotate_info);
       annotate=DestroyDrawInfo(annotate);
       textlist=(char **) RelinquishMagickMemory(textlist);
+      text=DestroyString(text);
       return(MagickFalse);
     }
   if (IsGrayColorspace(image->colorspace) != MagickFalse)
@@ -529,6 +531,7 @@ MagickExport MagickBooleanType AnnotateImage(Image *image,
   annotate_info=DestroyDrawInfo(annotate_info);
   annotate=DestroyDrawInfo(annotate);
   textlist=(char **) RelinquishMagickMemory(textlist);
+  text=DestroyString(text);
   return(status);
 }
 

programming_language: Objective-C
filename: fourier.c
change_type: ModificationType.MODIFY
diff: @@ -245,10 +245,14 @@ MagickExport Image *ComplexImages(const Image *images,const ComplexOperator op,
 
     if (status == MagickFalse)
       continue;
-    Ar=GetCacheViewVirtualPixels(Ar_view,0,y,Ar_image->columns,1,exception);
-    Ai=GetCacheViewVirtualPixels(Ai_view,0,y,Ai_image->columns,1,exception);
-    Br=GetCacheViewVirtualPixels(Br_view,0,y,Br_image->columns,1,exception);
-    Bi=GetCacheViewVirtualPixels(Bi_view,0,y,Bi_image->columns,1,exception);
+    Ar=GetCacheViewVirtualPixels(Ar_view,0,y,
+      MagickMax(Ar_image->columns,Cr_image->columns),1,exception);
+    Ai=GetCacheViewVirtualPixels(Ai_view,0,y,
+      MagickMax(Ai_image->columns,Ci_image->columns),1,exception);
+    Br=GetCacheViewVirtualPixels(Br_view,0,y,
+      MagickMax(Br_image->columns,Cr_image->columns),1,exception);
+    Bi=GetCacheViewVirtualPixels(Bi_view,0,y,
+      MagickMax(Bi_image->columns,Ci_image->columns),1,exception);
     Cr=QueueCacheViewAuthenticPixels(Cr_view,0,y,Cr_image->columns,1,exception);
     Ci=QueueCacheViewAuthenticPixels(Ci_view,0,y,Ci_image->columns,1,exception);
     if ((Ar == (const Quantum *) NULL) || (Ai == (const Quantum *) NULL) || 

programming_language: Objective-C