In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer overflow in the function WriteSGIImage of coders/sgi.c.
cpe:2.3:a:imagemagick:imagemagick:7.0.8-43:q16:*:*:*:*:*:*
2EDF50C4-9FFE-4EBF-A5BE-44AF7E6988D9
OR
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
902B8056-9E37-443B-8905-8AA93E2447FB
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
DEECE5FC-CACF-4496-A3E7-164736409252
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
07B237A9-69A3-4A9C-9DA0-4E06BD37AE73
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
B620311B-34A3-48A6-82DF-6F078D7A4493
OR
### Prerequisites

- [X] I have written a descriptive issue title
- [X] I have verified that I am using the latest version of ImageMagick
- [X] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->
There is a heap buffer overflow vulnerability in function WriteSGIImage of coders/sgi.c.
### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->
[poc](https://drive.google.com/open?id=1s1qxnLgAWnDOLL582hni6LgrvCnPddI0)
magick convert $poc ./test.sgi
`=================================================================`
`==41720==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f70c67db7f8 at pc 0x0000006c216f bp 0x7ffea64ddb50 sp 0x7ffea64ddb40`
`WRITE of size 1 at 0x7f70c67db7f8 thread T0`
`    #0 0x6c216e in WriteSGIImage coders/sgi.c:1051`
`    #1 0x849036 in WriteImage MagickCore/constitute.c:1159`
`    #2 0x849d5b in WriteImages MagickCore/constitute.c:1376`
`    #3 0xbf16d0 in ConvertImageCommand MagickWand/convert.c:3305`
`    #4 0xcdf180 in MagickCommandGenesis MagickWand/mogrify.c:185`
`    #5 0x4100a1 in MagickMain utilities/magick.c:149`
`    #6 0x410282 in main utilities/magick.c:180`
`    #7 0x7f70c10c882f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)`
`    #8 0x40fbb8 in _start (/home/test/temp/ImageMagick/utilities/magick+0x40fbb8)`

`0x7f70c67db7f8 is located 8 bytes to the left of 524288-byte region [0x7f70c67db800,0x7f70c685b800)`
`allocated by thread T0 here:`
`    #0 0x7f70c5868076 in __interceptor_posix_memalign (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x99076)`
`    #1 0x4408c7 in AcquireAlignedMemory MagickCore/memory.c:265`
`    #2 0x440beb in AcquireVirtualMemory MagickCore/memory.c:621`
`    #3 0x6c1ead in WriteSGIImage coders/sgi.c:1030`
`    #4 0x849036 in WriteImage MagickCore/constitute.c:1159`
`    #5 0x849d5b in WriteImages MagickCore/constitute.c:1376`
`    #6 0xbf16d0 in ConvertImageCommand MagickWand/convert.c:3305`
`    #7 0xcdf180 in MagickCommandGenesis MagickWand/mogrify.c:185`
`    #8 0x4100a1 in MagickMain utilities/magick.c:149`
`    #9 0x410282 in main utilities/magick.c:180`
`    #10 0x7f70c10c882f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)`

`SUMMARY: AddressSanitizer: heap-buffer-overflow coders/sgi.c:1051 WriteSGIImage`
`Shadow bytes around the buggy address:`
`  0x0fee98cf36a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa`
`  0x0fee98cf36b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa`
`  0x0fee98cf36c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa`
`  0x0fee98cf36d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa`
`  0x0fee98cf36e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa`
`=>0x0fee98cf36f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]`
`  0x0fee98cf3700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00`
`  0x0fee98cf3710: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00`
`  0x0fee98cf3720: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00`
`  0x0fee98cf3730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00`
`  0x0fee98cf3740: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00`
`Shadow byte legend (one shadow byte represents 8 application bytes):`
`  Addressable:           00`
`  Partially addressable: 01 02 03 04 05 06 07 `
`  Heap left redzone:       fa`
`  Heap right redzone:      fb`
`  Freed heap region:       fd`
`  Stack left redzone:      f1`
`  Stack mid redzone:       f2`
`  Stack right redzone:     f3`
`  Stack partial redzone:   f4`
`  Stack after return:      f5`
`  Stack use after scope:   f8`
`  Global redzone:          f9`
`  Global init order:       f6`
`  Poisoned by user:        f7`
`  Container overflow:      fc`
`  Array cookie:            ac`
`  Intra object redzone:    bb`
`  ASan internal:           fe`
`==41720==ABORTING`
### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version:
`Version: ImageMagick 7.0.8-43 Q16 x86_64 2019-04-29 https://imagemagick.org`
`Copyright: ? 1999-2019 ImageMagick Studio LLC`
`License: https://imagemagick.org/script/license.php`
`Features: Cipher DPC HDRI OpenMP(4.0) `
`Delegates (built-in): bzlib djvu fftw fontconfig freetype jbig jng jpeg lcms lqr lzma openexr pangocairo png tiff wmf x xml zlib`
- Environment (Operating system, version and so on):
`Distributor ID:	Ubuntu`
`Description:	Ubuntu 16.04.1 LTS`
`Release:	16.04`
`Codename:	xenial`
- Additional information:

<!-- Thanks for reporting the issue to ImageMagick! -->

heap-buffer-overflow in WriteSGIImage of coders/sgi.c
This is a GitHub Issue
repo:ImageMagick
owner:ImageMagick
Title : heap-buffer-overflow in WriteSGIImage of coders/sgi.c
Issue date:

--- start body ---
### Prerequisites

- [X] I have written a descriptive issue title
- [X] I have verified that I am using the latest version of ImageMagick
- [X] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->
There is a heap buffer overflow vulnerability in function WriteSGIImage of coders/sgi.c.
### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->
[poc](https://drive.google.com/open?id=1s1qxnLgAWnDOLL582hni6LgrvCnPddI0)
magick convert $poc ./test.sgi
`=================================================================`
`==41720==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f70c67db7f8 at pc 0x0000006c216f bp 0x7ffea64ddb50 sp 0x7ffea64ddb40`
`WRITE of size 1 at 0x7f70c67db7f8 thread T0`
`    #0 0x6c216e in WriteSGIImage coders/sgi.c:1051`
`    #1 0x849036 in WriteImage MagickCore/constitute.c:1159`
`    #2 0x849d5b in WriteImages MagickCore/constitute.c:1376`
`    #3 0xbf16d0 in ConvertImageCommand MagickWand/convert.c:3305`
`    #4 0xcdf180 in MagickCommandGenesis MagickWand/mogrify.c:185`
`    #5 0x4100a1 in MagickMain utilities/magick.c:149`
`    #6 0x410282 in main utilities/magick.c:180`
`    #7 0x7f70c10c882f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)`
`    #8 0x40fbb8 in _start (/home/test/temp/ImageMagick/utilities/magick+0x40fbb8)`

`0x7f70c67db7f8 is located 8 bytes to the left of 524288-byte region [0x7f70c67db800,0x7f70c685b800)`
`allocated by thread T0 here:`
`    #0 0x7f70c5868076 in __interceptor_posix_memalign (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x99076)`
`    #1 0x4408c7 in AcquireAlignedMemory MagickCore/memory.c:265`
`    #2 0x440beb in AcquireVirtualMemory MagickCore/memory.c:621`
`    #3 0x6c1ead in WriteSGIImage coders/sgi.c:1030`
`    #4 0x849036 in WriteImage MagickCore/constitute.c:1159`
`    #5 0x849d5b in WriteImages MagickCore/constitute.c:1376`
`    #6 0xbf16d0 in ConvertImageCommand MagickWand/convert.c:3305`
`    #7 0xcdf180 in MagickCommandGenesis MagickWand/mogrify.c:185`
`    #8 0x4100a1 in MagickMain utilities/magick.c:149`
`    #9 0x410282 in main utilities/magick.c:180`
`    #10 0x7f70c10c882f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)`

`SUMMARY: AddressSanitizer: heap-buffer-overflow coders/sgi.c:1051 WriteSGIImage`
`Shadow bytes around the buggy address:`
`  0x0fee98cf36a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa`
`  0x0fee98cf36b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa`
`  0x0fee98cf36c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa`
`  0x0fee98cf36d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa`
`  0x0fee98cf36e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa`
`=>0x0fee98cf36f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]`
`  0x0fee98cf3700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00`
`  0x0fee98cf3710: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00`
`  0x0fee98cf3720: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00`
`  0x0fee98cf3730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00`
`  0x0fee98cf3740: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00`
`Shadow byte legend (one shadow byte represents 8 application bytes):`
`  Addressable:           00`
`  Partially addressable: 01 02 03 04 05 06 07 `
`  Heap left redzone:       fa`
`  Heap right redzone:      fb`
`  Freed heap region:       fd`
`  Stack left redzone:      f1`
`  Stack mid redzone:       f2`
`  Stack right redzone:     f3`
`  Stack partial redzone:   f4`
`  Stack after return:      f5`
`  Stack use after scope:   f8`
`  Global redzone:          f9`
`  Global init order:       f6`
`  Poisoned by user:        f7`
`  Container overflow:      fc`
`  Array cookie:            ac`
`  Intra object redzone:    bb`
`  ASan internal:           fe`
`==41720==ABORTING`
### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version:
`Version: ImageMagick 7.0.8-43 Q16 x86_64 2019-04-29 https://imagemagick.org`
`Copyright: ? 1999-2019 ImageMagick Studio LLC`
`License: https://imagemagick.org/script/license.php`
`Features: Cipher DPC HDRI OpenMP(4.0) `
`Delegates (built-in): bzlib djvu fftw fontconfig freetype jbig jng jpeg lcms lqr lzma openexr pangocairo png tiff wmf x xml zlib`
- Environment (Operating system, version and so on):
`Distributor ID:	Ubuntu`
`Description:	Ubuntu 16.04.1 LTS`
`Release:	16.04`
`Codename:	xenial`
- Additional information:

<!-- Thanks for reporting the issue to ImageMagick! -->

--- end body ---

comments :
--- start comments ---

--- end comments ---