CVE-2019-10714 (published 2019-04-02T21:29Z)

LocaleLowercase in MagickCore/locale.c in ImageMagick before 7.0.8-32 allows out-of-bounds access, leading to a SIGSEGV.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2019-03-04 19:58:00-05:00
msg: ...
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,10 @@
+2019-03-05  7.0.8-32 Cristy  <quetzlzacatenango@image...>
+  * Release ImageMagick version 7.0.8-32, GIT revision ...
+
+2019-03-05  7.0.8-32 Cristy  <quetzlzacatenango@image...>
+  * Fix out-of-boundary LocaleLowerCase() @
+    https://github.com/ImageMagick/ImageMagick/issues/1495
+
 2019-03-04  7.0.8-31 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.8-31, GIT revision 15381:3122a669d:20190304
 

programming_language: Markdown
filename: locale.c
change_type: ModificationType.MODIFY
diff: @@ -1521,6 +1521,8 @@ MagickExport void LocaleLower(char *string)
 */
 MagickExport int LocaleLowercase(const int c)
 {
+  if (c < 0)
+    return(c);
 #if defined(MAGICKCORE_LOCALE_SUPPORT)
   if (c_locale != (locale_t) NULL)
     return(tolower_l((int) ((unsigned char) c),c_locale));
@@ -1659,6 +1661,8 @@ MagickExport void LocaleUpper(char *string)
 */
 MagickExport int LocaleUppercase(const int c)
 {
+  if (c < 0)
+    return(c);
 #if defined(MAGICKCORE_LOCALE_SUPPORT)
   if (c_locale != (locale_t) NULL)
     return(toupper_l((int) ((unsigned char) c),c_locale));

programming_language: Objective-C
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2019-03-04 19:59:09-05:00
msg: ...
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: locale.c
change_type: ModificationType.MODIFY
diff: @@ -1521,7 +1521,7 @@ MagickExport void LocaleLower(char *string)
 */
 MagickExport int LocaleLowercase(const int c)
 {
-  if (c < 0)
+  if (c == EOF)
     return(c);
 #if defined(MAGICKCORE_LOCALE_SUPPORT)
   if (c_locale != (locale_t) NULL)
@@ -1661,7 +1661,7 @@ MagickExport void LocaleUpper(char *string)
 */
 MagickExport int LocaleUppercase(const int c)
 {
-  if (c < 0)
+  if (c == EOF)
     return(c);
 #if defined(MAGICKCORE_LOCALE_SUPPORT)
   if (c_locale != (locale_t) NULL)

programming_language: Objective-C
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2019-03-04 19:25:01-05:00
msg: ...
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: locale.c
change_type: ModificationType.MODIFY
diff: @@ -1523,9 +1523,9 @@ MagickExport int LocaleLowercase(const int c)
 {
 #if defined(MAGICKCORE_LOCALE_SUPPORT)
   if (c_locale != (locale_t) NULL)
-    return(tolower_l(c,c_locale));
+    return(tolower_l((int) ((unsigned char) c),c_locale));
 #endif
-  return(tolower(c));
+  return(tolower((int) ((unsigned char) c)));
 }
 
 /*
@@ -1661,9 +1661,9 @@ MagickExport int LocaleUppercase(const int c)
 {
 #if defined(MAGICKCORE_LOCALE_SUPPORT)
   if (c_locale != (locale_t) NULL)
-    return(toupper_l(c,c_locale));
+    return(toupper_l((int) ((unsigned char) c),c_locale));
 #endif
-  return(toupper(c));
+  return(toupper((int) ((unsigned char) c)));
 }
 
 /*

programming_language: Objective-C