In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WriteTIFFImage of coders/tiff.c, which allows an attacker to cause a denial of service or possibly information disclosure via a crafted image file.
cpe:2.3:a:imagemagick:imagemagick:7.0.8-43:q16:*:*:*:*:*:*
2EDF50C4-9FFE-4EBF-A5BE-44AF7E6988D9
OR
### Prerequisites

- [X] I have written a descriptive issue title
- [X] I have verified that I am using the latest version of ImageMagick
- [X] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->
There is a heap buffer overflow vulnerability in function WriteTIFFImage of coders/tiff.c.
### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->
[poc](https://drive.google.com/open?id=1VPmM34DHDhFYJCMKvRYIAH4iT14hVsOE)
magick convert $poc /dev/null
`=================================================================`
`==2369==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000ab14 at pc 0x7f24afc30935 bp 0x7ffe0bdcba20 sp 0x7ffe0bdcb1c8`
`READ of size 131072 at 0x60200000ab14 thread T0`
`    #0 0x7f24afc30934 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8c934)`
`    #1 0x7f24af23823a  (/usr/lib/x86_64-linux-gnu/libtiff.so.5+0x1823a)`
`    #2 0x7a3fed in WriteTIFFImage coders/tiff.c:4314`
`    #3 0x848ecb in WriteImage MagickCore/constitute.c:1159`
`    #4 0x849bf0 in WriteImages MagickCore/constitute.c:1376`
`    #5 0xbf1565 in ConvertImageCommand MagickWand/convert.c:3305`
`    #6 0xcdf015 in MagickCommandGenesis MagickWand/mogrify.c:185`
`    #7 0x4100a1 in MagickMain utilities/magick.c:149`
`    #8 0x410282 in main utilities/magick.c:180`
`    #9 0x7f24ab49d82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)`
`    #10 0x40fbb8 in _start (/home/ImageMagick/utilities/magick+0x40fbb8)`
``
`0x60200000ab14 is located 0 bytes to the right of 4-byte region [0x60200000ab10,0x60200000ab14)`
`allocated by thread T0 here:`
`    #0 0x7f24afc3c602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)`
`    #1 0x7f24af2293d4  (/usr/lib/x86_64-linux-gnu/libtiff.so.5+0x93d4)`
``
`SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memcpy`
`Shadow bytes around the buggy address:`
`  0x0c047fff9510: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa`
`  0x0c047fff9520: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa`
`  0x0c047fff9530: fa fa fa fa fa fa fa fa fa fa fd fa fa fa fd fa`
`  0x0c047fff9540: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa`
`  0x0c047fff9550: fa fa fd fa fa fa fd fa fa fa 04 fa fa fa 04 fa`
`=>0x0c047fff9560: fa fa[04]fa fa fa 00 fa fa fa fd fd fa fa fd fd`
`  0x0c047fff9570: fa fa 00 00 fa fa fd fa fa fa fd fa fa fa fd fa`
`  0x0c047fff9580: fa fa 00 fa fa fa 00 fa fa fa fd fa fa fa fd fd`
`  0x0c047fff9590: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04`
`  0x0c047fff95a0: fa fa 00 04 fa fa 00 04 fa fa 00 07 fa fa 03 fa`
`  0x0c047fff95b0: fa fa 00 03 fa fa 00 04 fa fa fd fd fa fa fd fd`
`Shadow byte legend (one shadow byte represents 8 application bytes):`
`  Addressable:           00`
`  Partially addressable: 01 02 03 04 05 06 07 `
`  Heap left redzone:       fa`
`  Heap right redzone:      fb`
`  Freed heap region:       fd`
`  Stack left redzone:      f1`
`  Stack mid redzone:       f2`
`  Stack right redzone:     f3`
`  Stack partial redzone:   f4`
`  Stack after return:      f5`
`  Stack use after scope:   f8`
`  Global redzone:          f9`
`  Global init order:       f6`
`  Poisoned by user:        f7`
`  Container overflow:      fc`
`  Array cookie:            ac`
`  Intra object redzone:    bb`
`  ASan internal:           fe`
`==2369==ABORTING`
### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version:
`Version: ImageMagick 7.0.8-43 Q16 x86_64 2019-04-27 https://imagemagick.org`
`Copyright: ? 1999-2019 ImageMagick Studio LLC`
`License: https://imagemagick.org/script/license.php`
`Features: Cipher DPC HDRI OpenMP(4.0) `
`Delegates (built-in): bzlib djvu fftw fontconfig freetype jbig jng jpeg lcms lqr lzma openexr pangocairo png tiff wmf x xml zlib`
- Environment (Operating system, version and so on):
`Distributor ID:	Ubuntu`
`Description:	Ubuntu 16.04.1 LTS`
`Release:	16.04`
`Codename:	xenial`
- Additional information:

<!-- Thanks for reporting the issue to ImageMagick! -->

heap_buffer_overflow in WriteTIFFImage of coders/tiff.c
This is a GitHub Issue
repo:ImageMagick
owner:ImageMagick
Title : heap_buffer_overflow in WriteTIFFImage of coders/tiff.c
Issue date:

--- start body ---
### Prerequisites

- [X] I have written a descriptive issue title
- [X] I have verified that I am using the latest version of ImageMagick
- [X] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description
<!-- A description of the bug or feature -->
There is a heap buffer overflow vulnerability in function WriteTIFFImage of coders/tiff.c.
### Steps to Reproduce
<!-- List of steps, sample code, failing test or link to a project that reproduces the behavior.
     Make sure you place a stack trace inside a code (```) block to avoid linking unrelated issues -->
[poc](https://drive.google.com/open?id=1VPmM34DHDhFYJCMKvRYIAH4iT14hVsOE)
magick convert $poc /dev/null
`=================================================================`
`==2369==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000ab14 at pc 0x7f24afc30935 bp 0x7ffe0bdcba20 sp 0x7ffe0bdcb1c8`
`READ of size 131072 at 0x60200000ab14 thread T0`
`    #0 0x7f24afc30934 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8c934)`
`    #1 0x7f24af23823a  (/usr/lib/x86_64-linux-gnu/libtiff.so.5+0x1823a)`
`    #2 0x7a3fed in WriteTIFFImage coders/tiff.c:4314`
`    #3 0x848ecb in WriteImage MagickCore/constitute.c:1159`
`    #4 0x849bf0 in WriteImages MagickCore/constitute.c:1376`
`    #5 0xbf1565 in ConvertImageCommand MagickWand/convert.c:3305`
`    #6 0xcdf015 in MagickCommandGenesis MagickWand/mogrify.c:185`
`    #7 0x4100a1 in MagickMain utilities/magick.c:149`
`    #8 0x410282 in main utilities/magick.c:180`
`    #9 0x7f24ab49d82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)`
`    #10 0x40fbb8 in _start (/home/ImageMagick/utilities/magick+0x40fbb8)`
``
`0x60200000ab14 is located 0 bytes to the right of 4-byte region [0x60200000ab10,0x60200000ab14)`
`allocated by thread T0 here:`
`    #0 0x7f24afc3c602 in malloc (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x98602)`
`    #1 0x7f24af2293d4  (/usr/lib/x86_64-linux-gnu/libtiff.so.5+0x93d4)`
``
`SUMMARY: AddressSanitizer: heap-buffer-overflow ??:0 __asan_memcpy`
`Shadow bytes around the buggy address:`
`  0x0c047fff9510: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa`
`  0x0c047fff9520: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa`
`  0x0c047fff9530: fa fa fa fa fa fa fa fa fa fa fd fa fa fa fd fa`
`  0x0c047fff9540: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fa`
`  0x0c047fff9550: fa fa fd fa fa fa fd fa fa fa 04 fa fa fa 04 fa`
`=>0x0c047fff9560: fa fa[04]fa fa fa 00 fa fa fa fd fd fa fa fd fd`
`  0x0c047fff9570: fa fa 00 00 fa fa fd fa fa fa fd fa fa fa fd fa`
`  0x0c047fff9580: fa fa 00 fa fa fa 00 fa fa fa fd fa fa fa fd fd`
`  0x0c047fff9590: fa fa 00 04 fa fa 00 04 fa fa 00 04 fa fa 00 04`
`  0x0c047fff95a0: fa fa 00 04 fa fa 00 04 fa fa 00 07 fa fa 03 fa`
`  0x0c047fff95b0: fa fa 00 03 fa fa 00 04 fa fa fd fd fa fa fd fd`
`Shadow byte legend (one shadow byte represents 8 application bytes):`
`  Addressable:           00`
`  Partially addressable: 01 02 03 04 05 06 07 `
`  Heap left redzone:       fa`
`  Heap right redzone:      fb`
`  Freed heap region:       fd`
`  Stack left redzone:      f1`
`  Stack mid redzone:       f2`
`  Stack right redzone:     f3`
`  Stack partial redzone:   f4`
`  Stack after return:      f5`
`  Stack use after scope:   f8`
`  Global redzone:          f9`
`  Global init order:       f6`
`  Poisoned by user:        f7`
`  Container overflow:      fc`
`  Array cookie:            ac`
`  Intra object redzone:    bb`
`  ASan internal:           fe`
`==2369==ABORTING`
### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version:
`Version: ImageMagick 7.0.8-43 Q16 x86_64 2019-04-27 https://imagemagick.org`
`Copyright: ? 1999-2019 ImageMagick Studio LLC`
`License: https://imagemagick.org/script/license.php`
`Features: Cipher DPC HDRI OpenMP(4.0) `
`Delegates (built-in): bzlib djvu fftw fontconfig freetype jbig jng jpeg lcms lqr lzma openexr pangocairo png tiff wmf x xml zlib`
- Environment (Operating system, version and so on):
`Distributor ID:	Ubuntu`
`Description:	Ubuntu 16.04.1 LTS`
`Release:	16.04`
`Codename:	xenial`
- Additional information:

<!-- Thanks for reporting the issue to ImageMagick! -->

--- end body ---

comments :
--- start comments ---

--- end comments ---