CVE-2020-25674

WriteOnePNGImage() from coders/png.c (the PNG coder) has a for loop with an
improper exit condition that can allow an out-of-bounds READ via
heap-buffer-overflow. This occurs because it is possible for the colormap
to have less than 256 valid values but the loop condition will loop 256
times, attempting to pass invalid colormap data to the event logger. The
patch replaces the hardcoded 256 value with a call to MagickMin() to ensure
the proper value is used. This could impact application availability when a
specially crafted input file is processed by ImageMagick. This flaw affects
ImageMagick versions prior to 7.0.8-68.

Bugs

• <https://github.com/ImageMagick/ImageMagick/issues/1715&gt;