Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c in ImageMagick 7.0.10-7.
### Prerequisites

- [✅ ] I have written a descriptive issue title
- [ ✅] I have verified that I am using the latest version of ImageMagick
- [ ✅] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description

There's a stack buffer overflow at /coders/xpm.c:232 in ReadXPMImage

[poc](https://raw.githubusercontent.com/minghangshen/bug_poc/master/poc2/stack-buffer-over1)

### Steps to Reproduce
run_cmd

`magick convert ./afl-Ima/sync_dir/fuzzer2/crashes/id\:000000\,sig\:06\,src\:009314\,op\:havoc\,rep\:16  t.png`

Here's ASAN log.

```
==22728==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff34696d60 at pc 0x7fb49cb4a648 bp 0x7fff34694c80 sp 0x7fff34694c70
READ of size 1 at 0x7fff34696d60 thread T0
    #0 0x7fb49cb4a647 in ParseXPMColor /home/afl-Ima/ImageMagick/coders/xpm.c:232
    #1 0x7fb49cb3d610 in ReadXPMImage /home/afl-Ima/ImageMagick/coders/xpm.c:425
    #2 0x7fb49beb03c9 in ReadImage /home/afl-Ima/ImageMagick/MagickCore/constitute.c:553
    #3 0x7fb49beb4d46 in ReadImages /home/afl-Ima/ImageMagick/MagickCore/constitute.c:941
    #4 0x7fb49b594ed2 in ConvertImageCommand /home/afl-Ima/ImageMagick/MagickWand/convert.c:606
    #5 0x7fb49b6cd098 in MagickCommandGenesis /home/afl-Ima/ImageMagick/MagickWand/mogrify.c:186
    #6 0x55be14ba8ec0 in MagickMain utilities/magick.c:149
    #7 0x55be14ba9146 in main utilities/magick.c:180
    #8 0x7fb49ae56b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #9 0x55be14ba8939 in _start (/home/ImageMagick/utilities/.libs/magick+0x1939)

Address 0x7fff34696d60 is located in stack of thread T0 at offset 8352 in frame
    #0 0x7fb49cb3adef in ReadXPMImage /home/afl-Ima/ImageMagick/coders/xpm.c:250

  This frame has 7 object(s):
    [32, 4128) 'key:251'
    [4256, 8352) 'target:251' <== Memory access at offset 8352 overflows this variable
    [8480, 8488) 'colors:286'
    [8512, 8520) 'columns:286'
    [8544, 8552) 'rows:286'
    [8576, 8584) 'width:286'
    [8608, 12704) 'symbolic:398'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/afl-Ima/ImageMagick/coders/xpm.c:232 in ParseXPMColor
Shadow bytes around the buggy address:
  0x1000668cad50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cad60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cad70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cad80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cad90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x1000668cada0: 00 00 00 00 00 00 00 00 00 00 00 00[f2]f2 f2 f2
  0x1000668cadb0: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2
  0x1000668cadc0: 00 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00
  0x1000668cadd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cade0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cadf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==22728==ABORTING

```
### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version:
Version: ImageMagick 7.0.10-7 Q16 x86_64 2020-04-10 https://imagemagick.org
Copyright: © 1999-2020 ImageMagick Studio LLC
License: https://imagemagick.org/script/license.php
Features: Cipher DPC HDRI OpenMP(3.1) 
Delegates (built-in): zlib
- Environment (Operating system, version and so on):
Description: Ubuntu 18.04.1 LTS
- Additional information:
```
root@VM-0-15-ubuntu:/home# ./ImageMagick/utilities/.libs/magick identify -list policy

Path: /usr/local/etc/ImageMagick-7/policy.xml
  Policy: Resource
    name: list-length
    value: 128
  Policy: Resource
    name: file
    value: 768
  Policy: Resource
    name: disk
    value: 16EiB
  Policy: Resource
    name: map
    value: 4GiB
  Policy: Resource
    name: area
    value: 100MP
  Policy: Resource
    name: height
    value: 10KP
  Policy: Resource
    name: width
    value: 10KP

Path: [built-in]
  Policy: Undefined
    rights: None 

```

edit by peanuts 
, and Is it possible to request a cve id？
<!-- Thanks for reporting the issue to ImageMagick! -->

stack-buffer-overflow at /coders/xpm.c:232 in ReadXPMImage
This is a GitHub Issue
repo:ImageMagick
owner:ImageMagick
Title : stack-buffer-overflow at /coders/xpm.c:232 in ReadXPMImage
Issue date:

--- start body ---
### Prerequisites

- [✅ ] I have written a descriptive issue title
- [ ✅] I have verified that I am using the latest version of ImageMagick
- [ ✅] I have searched [open](https://github.com/ImageMagick/ImageMagick/issues) and [closed](https://github.com/ImageMagick/ImageMagick/issues?q=is%3Aissue+is%3Aclosed) issues to ensure it has not already been reported

### Description

There's a stack buffer overflow at /coders/xpm.c:232 in ReadXPMImage

[poc](https://raw.githubusercontent.com/minghangshen/bug_poc/master/poc2/stack-buffer-over1)

### Steps to Reproduce
run_cmd

`magick convert ./afl-Ima/sync_dir/fuzzer2/crashes/id\:000000\,sig\:06\,src\:009314\,op\:havoc\,rep\:16  t.png`

Here's ASAN log.

```
==22728==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fff34696d60 at pc 0x7fb49cb4a648 bp 0x7fff34694c80 sp 0x7fff34694c70
READ of size 1 at 0x7fff34696d60 thread T0
    #0 0x7fb49cb4a647 in ParseXPMColor /home/afl-Ima/ImageMagick/coders/xpm.c:232
    #1 0x7fb49cb3d610 in ReadXPMImage /home/afl-Ima/ImageMagick/coders/xpm.c:425
    #2 0x7fb49beb03c9 in ReadImage /home/afl-Ima/ImageMagick/MagickCore/constitute.c:553
    #3 0x7fb49beb4d46 in ReadImages /home/afl-Ima/ImageMagick/MagickCore/constitute.c:941
    #4 0x7fb49b594ed2 in ConvertImageCommand /home/afl-Ima/ImageMagick/MagickWand/convert.c:606
    #5 0x7fb49b6cd098 in MagickCommandGenesis /home/afl-Ima/ImageMagick/MagickWand/mogrify.c:186
    #6 0x55be14ba8ec0 in MagickMain utilities/magick.c:149
    #7 0x55be14ba9146 in main utilities/magick.c:180
    #8 0x7fb49ae56b96 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21b96)
    #9 0x55be14ba8939 in _start (/home/ImageMagick/utilities/.libs/magick+0x1939)

Address 0x7fff34696d60 is located in stack of thread T0 at offset 8352 in frame
    #0 0x7fb49cb3adef in ReadXPMImage /home/afl-Ima/ImageMagick/coders/xpm.c:250

  This frame has 7 object(s):
    [32, 4128) 'key:251'
    [4256, 8352) 'target:251' <== Memory access at offset 8352 overflows this variable
    [8480, 8488) 'colors:286'
    [8512, 8520) 'columns:286'
    [8544, 8552) 'rows:286'
    [8576, 8584) 'width:286'
    [8608, 12704) 'symbolic:398'
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow /home/afl-Ima/ImageMagick/coders/xpm.c:232 in ParseXPMColor
Shadow bytes around the buggy address:
  0x1000668cad50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cad60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cad70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cad80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cad90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x1000668cada0: 00 00 00 00 00 00 00 00 00 00 00 00[f2]f2 f2 f2
  0x1000668cadb0: f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2
  0x1000668cadc0: 00 f2 f2 f2 00 f2 f2 f2 00 f2 f2 f2 00 00 00 00
  0x1000668cadd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cade0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x1000668cadf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==22728==ABORTING

```
### System Configuration
<!-- Tell us about the environment where you are experiencing the bug -->

- ImageMagick version:
Version: ImageMagick 7.0.10-7 Q16 x86_64 2020-04-10 https://imagemagick.org
Copyright: © 1999-2020 ImageMagick Studio LLC
License: https://imagemagick.org/script/license.php
Features: Cipher DPC HDRI OpenMP(3.1) 
Delegates (built-in): zlib
- Environment (Operating system, version and so on):
Description: Ubuntu 18.04.1 LTS
- Additional information:
```
root@VM-0-15-ubuntu:/home# ./ImageMagick/utilities/.libs/magick identify -list policy

Path: /usr/local/etc/ImageMagick-7/policy.xml
  Policy: Resource
    name: list-length
    value: 128
  Policy: Resource
    name: file
    value: 768
  Policy: Resource
    name: disk
    value: 16EiB
  Policy: Resource
    name: map
    value: 4GiB
  Policy: Resource
    name: area
    value: 100MP
  Policy: Resource
    name: height
    value: 10KP
  Policy: Resource
    name: width
    value: 10KP

Path: [built-in]
  Policy: Undefined
    rights: None 

```

edit by peanuts 
, and Is it possible to request a cve id？
<!-- Thanks for reporting the issue to ImageMagick! -->

--- end body ---
