CVE-2019-13454 (published 2019-07-09T17:15Z)

ImageMagick 7.0.8-54 Q16 allows Division by Zero in RemoveDuplicateLayers in MagickCore/layer.c.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-369
cwe_name: Divide By Zero
description: The product divides a value by zero.
extended_description: This weakness typically occurs when an unexpected value is provided to the product, or if an error occurs that is not properly detected. It frequently occurs in calculations involving physical dimensions such as size, length, width, and height.
         

Fix information:
repo_url: https://github.com/ImageMagick/ImageMagick
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick
author: Cristy
author_date: 2019-07-08 06:14:34-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1629
repository: repo_url: https://github.com/ImageMagick/ImageMagick
repo_name: ImageMagick/ImageMagick
description: 🧙‍♂️ ImageMagick 7
repo_language: C
owner: ImageMagick
file_changes: filename: layer.c
change_type: ModificationType.MODIFY
diff: @@ -1584,45 +1584,47 @@ MagickExport void OptimizeImageTransparency(const Image *image,
 %    o exception: return any errors or warnings in this structure.
 %
 */
-MagickExport void RemoveDuplicateLayers(Image **images,
-     ExceptionInfo *exception)
+MagickExport void RemoveDuplicateLayers(Image **images,ExceptionInfo *exception)
 {
-  register Image
-    *curr,
-    *next;
-
   RectangleInfo
     bounds;
 
+  register Image
+    *image,
+    *next;
+
   assert((*images) != (const Image *) NULL);
   assert((*images)->signature == MagickCoreSignature);
   if ((*images)->debug != MagickFalse)
-    (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",(*images)->filename);
+    (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",
+      (*images)->filename);
   assert(exception != (ExceptionInfo *) NULL);
   assert(exception->signature == MagickCoreSignature);
-
-  curr=GetFirstImageInList(*images);
-  for (; (next=GetNextImageInList(curr)) != (Image *) NULL; curr=next)
+  image=GetFirstImageInList(*images);
+  for ( ; (next=GetNextImageInList(image)) != (Image *) NULL; image=next)
   {
-    if ( curr->columns != next->columns || curr->rows != next->rows
-         || curr->page.x != next->page.x || curr->page.y != next->page.y )
+    if ((image->columns != next->columns) || (image->rows != next->rows) ||
+        (image->page.x != next->page.x) || (image->page.y != next->page.y))
       continue;
-    bounds=CompareImagesBounds(curr,next,CompareAnyLayer,exception);
-    if ( bounds.x < 0 ) {
-      /*
-        the two images are the same, merge time delays and delete one.
-      */
-      size_t time;
-      time = curr->delay*1000/curr->ticks_per_second;
-      time += next->delay*1000/next->ticks_per_second;
-      next->ticks_per_second = 100L;
-      next->delay = time*curr->ticks_per_second/1000;
-      next->iterations = curr->iterations;
-      *images = curr;
-      (void) DeleteImageFromList(images);
-    }
+    bounds=CompareImagesBounds(image,next,CompareAnyLayer,exception);
+    if (bounds.x < 0)
+      {
+        /*
+          Two images are the same, merge time delays and delete one.
+        */
+        size_t
+          time;
+
+        time=1000*image->delay*PerceptibleReciprocal(image->ticks_per_second);
+        time+=1000*next->delay*PerceptibleReciprocal(next->ticks_per_second);
+        next->ticks_per_second=100L;
+        next->delay=time*image->ticks_per_second/1000;
+        next->iterations=image->iterations;
+        *images=image;
+        (void) DeleteImageFromList(images);
+      }
   }
-  *images = GetFirstImageInList(*images);
+  *images=GetFirstImageInList(*images);
 }
 
 /*

programming_language: Matlab
repo_url: https://github.com/ImageMagick/ImageMagick6
commit_details: repo_url: https://github.com/ImageMagick/ImageMagick6
author: Cristy
author_date: 2019-07-08 06:21:03-04:00
msg: https://github.com/ImageMagick/ImageMagick/issues/1629
repository: repo_url: https://github.com/ImageMagick/ImageMagick6
repo_name: ImageMagick/ImageMagick6
description: 🧙‍♂️ ImageMagick 6
repo_language: C
owner: ImageMagick
file_changes: filename: layer.c
change_type: ModificationType.MODIFY
diff: @@ -1639,45 +1639,47 @@ MagickExport void OptimizeImageTransparency(const Image *image,
 %    o exception: return any errors or warnings in this structure.
 %
 */
-MagickExport void RemoveDuplicateLayers(Image **images,
-     ExceptionInfo *exception)
+MagickExport void RemoveDuplicateLayers(Image **images,ExceptionInfo *exception)
 {
-  register Image
-    *curr,
-    *next;
-
   RectangleInfo
     bounds;
 
+  register Image
+    *image,
+    *next;
+
   assert((*images) != (const Image *) NULL);
   assert((*images)->signature == MagickCoreSignature);
   if ((*images)->debug != MagickFalse)
-    (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",(*images)->filename);
+    (void) LogMagickEvent(TraceEvent,GetMagickModule(),"%s",
+      (*images)->filename);
   assert(exception != (ExceptionInfo *) NULL);
   assert(exception->signature == MagickCoreSignature);
-
-  curr=GetFirstImageInList(*images);
-  for (; (next=GetNextImageInList(curr)) != (Image *) NULL; curr=next)
+  image=GetFirstImageInList(*images);
+  for ( ; (next=GetNextImageInList(image)) != (Image *) NULL; image=next)
   {
-    if ( curr->columns != next->columns || curr->rows != next->rows
-         || curr->page.x != next->page.x || curr->page.y != next->page.y )
+    if ((image->columns != next->columns) || (image->rows != next->rows) ||
+        (image->page.x != next->page.x) || (image->page.y != next->page.y))
       continue;
-    bounds=CompareImageBounds(curr,next,CompareAnyLayer,exception);
-    if ( bounds.x < 0 ) {
-      /*
-        the two images are the same, merge time delays and delete one.
-      */
-      size_t time;
-      time = curr->delay*1000/curr->ticks_per_second;
-      time += next->delay*1000/next->ticks_per_second;
-      next->ticks_per_second = 100L;
-      next->delay = time*curr->ticks_per_second/1000;
-      next->iterations = curr->iterations;
-      *images = curr;
-      (void) DeleteImageFromList(images);
-    }
+    bounds=CompareImageBounds(image,next,CompareAnyLayer,exception);
+    if (bounds.x < 0)
+      {
+        /*
+          Two images are the same, merge time delays and delete one.
+        */
+        size_t
+          time;
+
+        time=1000*image->delay*PerceptibleReciprocal(image->ticks_per_second);
+        time+=1000*next->delay*PerceptibleReciprocal(next->ticks_per_second);
+        next->ticks_per_second=100L;
+        next->delay=time*image->ticks_per_second/1000;
+        next->iterations=image->iterations;
+        *images=image;
+        (void) DeleteImageFromList(images);
+      }
   }
-  *images = GetFirstImageInList(*images);
+  *images=GetFirstImageInList(*images);
 }
 
 /*

programming_language: Matlab